Continuous glucose monitor communication with multiple display devices

ABSTRACT

A continuous glucose monitor for wirelessly transmitting data relating to glucose value to a plurality of displays is disclosed, as well as systems and methods for limiting the number of display devices that can connect to a continuous glucose transmitter. In addition, security, including hashing techniques and a changing application key, can be used to provide secure communications between the continuous glucose transmitter and the displays. Also provided is a continuous glucose monitor and techniques for authenticating multiple displays, providing secure data transmissions to multiple displays, and coordinating the interaction of commands and data updates between multiple displays.

INCORPORATION BY REFERENCE TO RELATED APPLICATIONS

Any and all priority claims identified in the Application Data Sheet, orany correction thereto, are hereby incorporated by reference under 37CFR 1.57. This application is a continuation of U.S. application Ser.No. 15/001,756, filed Jan. 20, 2016, which claims the benefit of U.S.Provisional Application No. 62/106,150, filed Jan. 21, 2015. Each of theaforementioned applications is incorporated by reference herein in itsentirety, and each is hereby expressly made a part of thisspecification.

TECHNICAL FIELD

The present disclosure relates to a continuous glucose sensor thattransmits data relating to glucose levels to multiple displays in asecure fashion.

BACKGROUND

Continuous glucose monitors have been increasing in popularity as aneasy way to monitor glucose levels. In the past, users sample theirblood glucose levels several times throughout a day, such as in themorning, around lunch, and in the evening. The levels can be measured bytaking a small blood sample and measuring the glucose levels with a teststrip or blood glucose meter. This technique, however, has drawbacksbecause users would prefer to not have to take a blood sample, and usersdo not know what their glucose levels are throughout the day between thesamples.

One potentially dangerous timeframe is at night because a user's glucoselevels can fall dangerously low during sleep. As a result, continuousglucose monitors have gained popularity by providing a sensor thatcontinuously monitors glucose levels and transmits the glucose levelswirelessly to a display. This allows the user to monitor their glucoselevels throughout the day and even set alarms for when glucose levelsreach a predefined level or experience a defined change.

Initially, continuous glucose monitors wirelessly transmitted datarelating to glucose levels to a receiver acting as a dedicated display.The dedicated display can be a medical device designed to displayglucose levels, trending patterns, and other information for a user.However, with the increasing popularity of smart phones and applicationsexecuting on smart phones, some users prefer to avoid having to carry adedicated display. Instead, users would prefer to monitor their glucoselevels using an application executing on a smartphone, alone or alongwith a dedicated display.

The present disclosure is directed to overcoming these and otherproblems.

SUMMARY

The disclosure relates to allowing users to carry and monitor glucoselevels using a plurality of displays, such as a dedicated displayassociated with a continuous glucose monitor system and a smart phone,tablet, personal computer, or other device. Users can carry two displaysand monitor glucose levels with different displays at different times.For example, a user may use their smart phone application sometimes, butthen their smart phone application may be turned off and the user willswitch to using a dedicated display. The disclosed system coordinatesthe transmission and display of the same data on two separate displaysto ensure consistency. Commands from both displays can be received andprocessed in a timely fashion, and both displays can display the samedata.

In other embodiments, a user can send commands from the dedicateddisplay, the smart phone, or both to control the continuous glucosemonitor system. Given the timing of when a user enters a command on aparticular display, the two displays may actually display differentdata. For example, a user may enter a calibration command on a firstdisplay that is only processed after the current glucose data has beensent to a second display. The first display will therefore displaydifferent glucose levels based on the new calibration, while the seconddisplay will continue to display old data. Systems and methods describedbelow ensure consistency of data display across multiple devices.

In addition, the disclosure provides for secure communications withinthe system. Medical devices wirelessly transmit sensitive medical datafor a patient. Ensuring that communications only occur between approved,authenticated devices can be a key to offering users an appropriatelevel of security given the sensitive nature of the data beingtransmitted. Broadcasting glucose readings and related informationbetween a glucose sensor and transmitter can compromise the data withoutauthentication or other techniques for securing communications. Forexample, a second user's display may receive glucose data for anotheruser, causing confusion and a breach of privacy. There is therefore aneed for secure communications between a glucose sensor and multipledisplays. Examples of securing communications include requiring anauthentication protocol before a device can use data, and usingencryption to prevent unauthorized access.

Transmitting glucose data to multiple displays also places a strain onthe battery of the glucose sensor and transmitter. Each display shouldbe authenticated, paired, and receive the data, which compoundscommunications as additional displays are added. Therefore, in someembodiments, the number of displays that can connect to a particulartransmitter at any given time can be limited. Users should also be ableto add or remove a given display from being able to communicate with theglucose sensor.

In one exemplary embodiment, a method for pairing a transmitter of acontinuous glucose monitoring system with a plurality of display devicesis disclosed. The method may include connecting a first display deviceto the transmitter over a first wireless connection, connecting a seconddisplay device to the transmitter over a second wireless connection, andlimiting the number of display devices connected to the transmitter byrejecting additional connection requests during a communicationinterval. The method may also include exchanging an application key withthe first display device and the second display device periodically, theapplication key changing at the beginning of each period.

In another embodiment, a system for pairing a transmitter of acontinuous glucose monitoring system with a plurality of display devicesis disclosed. The system may include a first display device configuredto connect with the transmitter over a first wireless connection and asecond display device configured to connect with the transmitter over asecond wireless connection. The transmitter can be configured to limitthe number of connected display devices by rejecting additionalconnection requests during a communication interval, and exchange anapplication key with the first display device and the second displaydevice periodically, the application key changing at the beginning ofeach period.

A computer-readable medium is also disclosed comprising instructionswhich, when executed by one or more processors, perform a method forpairing a transmitter of a continuous glucose monitoring system with aplurality of display devices. The method may include connecting a firstdisplay device to the transmitter over a first wireless connection,connecting a second display device to the transmitter over a secondwireless connection, and limiting the number of display devicesconnected to the transmitter by rejecting additional connection requestsduring a communication interval. It also includes exchanging anapplication key with the first display device and the second displaydevice periodically, the application key changing at the beginning ofeach period.

In another embodiment, a method for pairing a transmitter of acontinuous glucose monitoring system with a display device is disclosedthat includes receiving a first identifier from the display device,creating a first hashed value by executing a hash algorithm on the firstidentifier, receiving an advertisement signal from the transmitter,parsing at least one of the advertisement signal or signals associatedwith the advertisement signal to identify a second hashed value, thesecond hashed value comprising a portion of a transmitter identifierassociated with the transmitter, comparing the first hashed value andthe second hashed value, denying connection between the transmitter andthe display device when the first hashed value and the second hashedvalue do not match, and allowing connection between the transmitter andthe display device when the first hashed value and the second hashedvalue match.

In another embodiment, one or more computer-readable media are disclosedcomprising instructions which, when executed by one or more processors,perform a method for pairing a transmitter of a continuous glucosemonitoring system with a display device. The method may includereceiving a first identifier from the display device, creating a firsthashed value by executing a hash algorithm on the first identifier,receiving an advertisement signal from the transmitter, parsing at leastone of the advertisement signal or signals associated with theadvertisement signal to identify a second hashed value, the secondhashed value comprising a portion of a transmitter identifier associatedwith the transmitter, comparing the first hashed value and the secondhashed value, denying connection between the transmitter and the displaydevice when the first hashed value and the second hashed value do notmatch, and allowing connection between the transmitter and the displaydevice when the first hashed value and the second hashed value match.

In another embodiment, a system is disclosed for pairing a transmitterof a continuous glucose monitoring system with a display device. Thesystem includes a wireless receiver in the first display deviceconfigured to receive a first identifier, and a processor in the firstdisplay device configured to create a first hashed value by executing ahash algorithm on the first identifier, receive an advertisement signalfrom the transmitter, parse at least one of the advertisement signal orsignals associated with the advertisement signal to identify a secondhashed value, the second hashed value comprising a portion of atransmitter identifier associated with the transmitter, compare thefirst hashed value and the second hashed value, deny connection betweenthe transmitter and the display device when the first hashed value andthe second hashed value do not match, and allow connection between thetransmitter and the display device when the first hashed value and thesecond hashed value match.

In another embodiment, a method is disclosed for pairing a transmitterof a continuous glucose monitoring system with a display device. Themethod includes receiving an advertisement signal from the transmitter,establishing a connection between the transmitter and the displaydevice, receiving a first key from the transmitter, comparing the firstkey with a second key stored by the display device, authenticating thetransmitter with the display device when the first key matches thesecond key, transmitting, after authenticating, an application key fromthe display device to the transmitter, receiving acceptance of theapplication key from the transmitter, allowing communication between thetransmitter and the display device after receiving acceptance of theapplication key, transmitting data relating to continuous glucose valuesfrom the transmitter to the display device, creating, by the displaydevice after an amount of time, a second application key, transmittingthe second application key from the display device to the transmitter,receiving acceptance of the second application key from the transmitter,and allowing further communication between the transmitter and thedisplay device after receiving acceptance of the new application key.

In another embodiment, one or more computer-readable media are disclosedcomprising instructions which, when executed by one or more processors,perform a method for pairing a transmitter of a continuous glucosemonitoring system with a display device, the method comprising receivingan advertisement signal from the transmitter, establishing a connectionbetween the transmitter and the display device, receiving a first keyfrom the transmitter, comparing the first key with a second key storedby the display device, authenticating the transmitter with the displaydevice when the first key matches the second key, transmitting, afterauthenticating, an application key from the display device to thetransmitter, receiving acceptance of the application key from thetransmitter, allowing communication between the transmitter and thedisplay device after receiving acceptance of the application key,transmitting data relating to continuous glucose values from thetransmitter to the display device, creating, by the display device afteran amount of time, a second application key, transmitting the secondapplication key from the display device to the transmitter, receivingacceptance of the second application key from the transmitter, andallowing further communication between the transmitter and the displaydevice after receiving acceptance of the new application key.

In another embodiment, a system is disclosed for pairing a transmitterof a continuous glucose monitoring system with a display device. Thesystem includes a transmitter configured to transmit an advertisementsignal, a display device configured to establish a connection with thetransmitter based on the advertisement signal, a wireless receiver inthe display device configured to receive a first key from thetransmitter, memory in the display device configured to store a secondkey, and a processor in the display device. The processor can comparethe first key with a second key, authenticate the transmitter with thedisplay device when the first key matches the second key, transmit,after authenticating, an application key to the transmitter, receiveacceptance of the application key from the transmitter, allowcommunication with the transmitter after receiving acceptance of theapplication key, receive data relating to continuous glucose values fromthe transmitter, create, after an amount of time, a second applicationkey, transmit the second application key to the transmitter, receiveacceptance of the second application key from the transmitter, and allowfurther communication between the transmitter and the display deviceafter receiving acceptance of the new application key.

In another embodiment, a method is disclosed for establishingcommunication between a plurality of display devices and a transmitterof a continuous glucose monitoring system. The method includes receivinga request to connect the transmitter with a first display device, therequest identifying a first type of the first display device, comparingthe first type of the first display device with a list including aplurality of allowed types of display devices, determining whether adisplay device having the first type is actively connected with thetransmitter, connecting the transmitter with the first display devicewhen fewer than a predetermined number of display devices with the firsttype are included in the list, receiving a request to connect thetransmitter with a second display device, the request identifying asecond type of the second display device, comparing the second type ofthe second display device with the list including a plurality of allowedtypes of display devices, determining whether a display device havingthe second type is actively connected with the transmitter, andconnecting the transmitter with the second display device when fewerthan the predetermined number of display devices with the second typeare included in the list.

In another embodiment, one or more computer-readable media are disclosedcomprising instructions which, when executed by one or more processors,perform a method for establishing communication between a plurality ofdisplay devices and a transmitter of a continuous glucose monitoringsystem. The method may include receiving a request to connect thetransmitter with a first display device, the request identifying a firsttype of the first display device, comparing the first type of the firstdisplay device with a list including a plurality of allowed types ofdisplay devices, determining whether a display device having the firsttype is actively connected with the transmitter, connecting thetransmitter with the first display device when fewer than apredetermined number of display devices with the first type are includedin the list, receiving a request to connect the transmitter with asecond display device, the request identifying a second type of thesecond display device, comparing the second type of the second displaydevice with the list including a plurality of allowed types of displaydevices, determining whether a display device having the second type isactively connected with the transmitter, and connecting the transmitterwith the second display device when fewer than the predetermined numberof display devices with the second type are included in the list.

In another embodiment, a system is disclosed for establishingcommunication between a plurality of display devices and a transmitterof a continuous glucose monitoring system. The system includes a firstdisplay device, a second display device, a wireless receiver in thetransmitter configured to receive a request to connect the transmitterwith a first display device, the request identifying a first type of thefirst display device, a memory in the transmitter configured to store alist of allowed types of display devices, and a processor in thetransmitter. The processor can compare the first type of the firstdisplay device with the list, determine whether a display device havingthe first type is actively connected with the transmitter, connect thetransmitter with the first display device when fewer than apredetermined number of display devices with the first type are includedin the list, receive a request to connect the transmitter with a seconddisplay device, the request identifying a second type of the seconddisplay device, compare the second type of the second display devicewith the list including a plurality of allowed types of display devices,determine whether a display device having the second type is activelyconnected with the transmitter, and connect the transmitter with thesecond display device when fewer than the predetermined number ofdisplay devices with the second type are included in the list.

In another embodiment, a method for establishing communication between aplurality of display devices and a transmitter of a continuous glucosemonitoring system is disclosed. The method may include creating a listof approved devices, the list including a plurality of types of devices,executing an authentication process with a first display device and thetransmitter, the authentication process including receiving anidentifier of the type of the first display device, adding the firstdisplay device to the list of approved devices, executing theauthentication process with a second display device and the transmitter,the authentication process including receiving an identifier of the typeof the second device, the type of the second device being different fromthe type of the first device, adding the second display device to thelist of approved devices, receiving a request to remove the firstdisplay device from the list, removing the first display device from thelist of approved devices, executing the authentication process with athird display device and the transmitter, the authentication processincluding receiving an identifier of the type of third device, the typeof the third device being the same as the type of the first device, andadding the third display device to the list of approved devices.

In another embodiment, one or more computer-readable media are disclosedcomprising instructions which, when executed by one or more processors,perform a method for establishing communication between a plurality ofdisplay devices and a transmitter of a continuous glucose monitoringsystem. The method may include creating a list of approved devices, thelist including a plurality of types of devices, executing anauthentication process with a first display device and the transmitter,the authentication process including receiving an identifier of the typeof the first display device, adding the first display device to the listof approved devices, executing the authentication process with a seconddisplay device and the transmitter, the authentication process includingreceiving an identifier of the type of the second device, the type ofthe second device being different from the type of the first device,adding the second display device to the list of approved devices,receiving a request to remove the first display device from the list,removing the first display device from the list of approved devices,executing the authentication process with a third display device and thetransmitter, the authentication process including receiving anidentifier of the type of third device, the type of the third devicebeing the same as the type of the first device, and adding the thirddisplay device to the list of approved devices.

In another embodiment, a system is disclosed for establishingcommunication between a plurality of display devices and a transmitterof a continuous glucose monitoring system. The system includes a firstdisplay device, a second display device, a memory associated with thetransmitter, the memory configured to store a list of approved devices,the list including a plurality of device types, and a processorassociated with the transmitter. The processor can execute anauthentication process with a first display device and the transmitter,the authentication process including receiving an identifier of the typeof the first display device, add the first display device to the list ofapproved devices, execute the authentication process with a seconddisplay device and the transmitter, the authentication process includingreceiving an identifier of the type of the second device, the type ofthe second device being different from the type of the first device, addthe second display device to the list of approved devices, receive arequest to remove the first display device from the list, remove thefirst display device from the list of approved devices, execute theauthentication process with a third display device and the transmitter,the authentication process including receiving an identifier of the typeof third device, the type of the third device being the same as the typeof the first device, and add the third display device to the list ofapproved devices.

In another embodiment, a method for exchanging commands between atransmitter of a continuous glucose monitoring system and one or moredisplay devices is disclosed. The method includes placing thetransmitter in an idle state, receiving a command at a first displaydevice, the command requiring exchange of data with the transmitter,placing the first display device in an intermediate state depending on atype of the command, transitioning the transmitter from the idle stateto an active state, transmitting the command from the first displaydevice to the transmitter, receiving a response including updated datarelating to control of the transmitter from the transmitter, removingthe first display device from the intermediate state, and displaying theupdated data by the first display.

In another embodiment, one or more computer-readable media are disclosedcomprising instructions which, when executed by one or more processors,perform a method for exchanging commands between a transmitter of acontinuous glucose monitoring system and one or more display devices.The method includes placing the transmitter in an idle state, receivinga command at a first display device, the command requiring exchange ofdata with the transmitter, placing the first display device in anintermediate state depending on a type of the command, transitioning thetransmitter from the idle state to an active state, transmitting thecommand from the first display device to the transmitter, receiving aresponse including updated data relating to control of the transmitterfrom the transmitter, removing the first display device from theintermediate state, and displaying the updated data by the firstdisplay.

In another embodiment, a system is disclosed for exchanging commandsbetween a transmitter of a continuous glucose monitoring system and oneor more display devices. The system includes a first display deviceconfigured to receive a command requiring exchange of data with thetransmitter and place the first display device in an intermediate statedepending on a type of the command. The system also includes a processorassociated with the transmitter, the processor configured to place thetransmitter in an idle state for a period of time, transition thetransmitter from the idle state to an active state, receive, during theactive state, the command from the first display device, and transmit aresponse to the first display device, the response including updateddata relating to control of the transmitter from the transmitter. Inresponse to receiving the response, the first display device ends theintermediate state by displaying the updated data.

In another embodiment, a method is disclosed for synchronizing datadisplayed on a first display device and a second display device. Themethod includes connecting the first display device with a transmitterof a continuous glucose monitoring system, connecting the second displaydevice with the transmitter, allowing transmission of commands to thetransmitter at specified times, receiving, by the first display deviceand the second display device, data relating to glucose levels from thetransmitter, receiving, at the first display device, a command relatingto calibration of a continuous glucose sensor, transmitting the commandrelating to calibration to the continuous glucose sensor at one of thespecified times, calculating, based on the command relating tocalibration, data relating to updated glucose levels, and transmittingthe data relating to updated glucose levels to the first display deviceand the second display device.

In another embodiment, one or more computer-readable media are disclosedcomprising instructions which, when executed by one or more processors,perform a method for synchronizing data displayed on a first displaydevice and a second display device. The method includes connecting thefirst display device with a transmitter of a continuous glucosemonitoring system, connecting the second display device with thetransmitter, allowing transmission of commands to the transmitter atspecified times, receiving, by the first display device and the seconddisplay device, data relating to glucose levels from the transmitter,receiving, at the first display device, a command relating tocalibration of a continuous glucose sensor, transmitting the commandrelating to calibration to the continuous glucose sensor at one of thespecified times, calculating, based on the command relating tocalibration, data relating to updated glucose levels, and transmittingthe data relating to updated glucose levels to the first display deviceand the second display device.

In another embodiment, a continuous glucose sensor is configured tosynchronize data displayed on a first display device and a seconddisplay device. The sensor includes a wireless transceiver configured towirelessly connect with the first display device and the second displaydevice, and a processor. The processor can transmit data relating toglucose levels to the first display device and the second displaydevice, receive a command relating to calibration of the continuousglucose sensor at a specified time, calculate, based on the commandrelating to calibration, data relating to updated glucose levels, andtransmit the data relating to updated glucose levels to the firstdisplay device and the second display device.

In another embodiment, a method for connecting a transmitter of acontinuous glucose system with a plurality of displays. The methodincludes advertising, by the transmitter, at a defined communicationinterval, receiving, in response to the advertising, requests from afirst display and a second display to connect with the transmitter,determining whether to authorize connections with the first display andthe second display based a device type for the first display and adevice type for the second display, executing an authentication processto pair the first display and the second display with the transmitterwhen the connections are authorized, and storing bonding informationassociated with the authentication process in memory.

In another embodiment, a system is disclosed for connecting atransmitter of a continuous glucose system with a plurality of displays.The transmitter is configured to receive, in response to theadvertising, requests from a first display and a second display toconnect with the transmitter, determine whether to authorize connectionswith the first display and the second display based a device type forthe first display and a device type for the second display, execute anauthentication process to pair the first display and the second displaywith the transmitter when the connections are authorized, and storebonding information associated with the authentication process inmemory.

In another embodiment, a computer-readable medium comprisinginstructions which, when executed by a processor, perform a method forconnecting a transmitter of a continuous glucose system with a pluralityof displays. The method includes advertising, by the transmitter, at adefined communication interval, receiving, in response to theadvertising, requests from a first display and a second display toconnect with the transmitter, determining whether to authorizeconnections with the first display and the second display based a devicetype for the first display and a device type for the second display,executing an authentication process to pair the first display and thesecond display with the transmitter when the connections are authorized,and storing bonding information associated with the authenticationprocess in memory.

Other systems, methods, features and/or advantages will be or may becomeapparent to one with skill in the art upon examination of the followingdrawings and detailed description. It is intended that all suchadditional systems, methods, features and/or advantages be includedwithin this description and be protected by the accompanying claims.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 illustrates an exemplary system for monitoring glucose levels.

FIG. 2 illustrates an exemplary method for connecting multiple displaydevices and securing wireless communications.

FIG. 3 illustrates an exemplary method for determining whether to allowa connection.

FIG. 4 illustrates an exemplary method for authenticating andestablishing communications between a continuous glucose sensor andmultiple displays.

FIG. 5 illustrates an exemplary method for updating an application key.

FIG. 6 illustrates an exemplary method for connecting a continuousglucose monitor to one or more displays based on a device type.

FIG. 7 illustrates an exemplary system diagram of storing connectioninformation.

FIG. 8 illustrates an exemplary method for removing displays fromauthorized lists of displays.

FIG. 9 illustrates an exemplary method for updating data in response toa command.

FIGS. 10A and 10B illustrate exemplary user interfaces for processing acommand.

FIG. 11 illustrates an exemplary method for updating multiple displaysin response to a command.

FIG. 12 illustrates an exemplary state diagram for a continuous glucosesensor and its transmitter connections.

FIG. 13 illustrates an exemplary embodiment of communications between acontinuous glucose sensor transmitter and a dedicated display or adisplay while authenticating and pairing.

FIG. 14 illustrates exemplary use cases in which a connection can berejected.

FIG. 15 illustrates exemplary use cases for connecting displays.

FIG. 16 illustrates an exemplary state diagram for a dedicated display.

FIG. 17 illustrates an exemplary method for calibrating a continuousglucose sensor with multiple displays.

FIG. 18 illustrates an exemplary system for monitoring glucose levels.

FIG. 19 illustrates an exemplary computer for monitoring glucose levels.

DETAILED DESCRIPTION

The present disclosure relates to a continuous glucose monitor andtechniques for authenticating multiple displays, providing secure datatransmissions to multiple displays, and coordinating the interaction ofcommands and data updates between multiple displays.

FIG. 1 illustrates an exemplary system for monitoring glucose levels.With reference to FIG. 1, continuous glucose sensor system 100 obtains aseries of measurements relating to glucose levels in a user. Thecontinuous glucose sensor system 100 can be worn, for example, in theabdomen region of a patient. A small sensor 103 can be placed on or intothe patient to obtain readings of glucose values using, for example,subcutaneous glucose or blood glucose readings. The sensor can be placedinto the patient using a needle that extends into the patient, depositsthe sensor, and then retracts and can be discarded. An applicator orother similar device can contain the needle and be used for insertingthe sensor. The continuous glucose sensor system 100 can also be atransdermal device, an intravascular device, or a non-invasive device.

Continuous glucose sensor system 100 may include a number of componentsto obtain glucose measurements, store the data, calculate glucoselevels, communicate with dedicated display 104 a and display 106 a, andperform other tasks. For example, although not illustrated, continuousglucose sensor system 100 may include nonvolatile memory for storinghistorical data regarding glucose values, a processor, a battery, and awireless transmitter 101. The wireless transmitter 101 may provide anytype of wireless communications 102 a and 102 b, including a Bluetoothconnection, WiFi connection, RF connection, and others. The wirelesscommunications 102 a and 102 b may occur, in some embodiments, betweenpaired, authenticated devices, and may use encryption and othercryptographic techniques to ensure that communications remainconfidential.

While illustrated as a single unit, the wireless transmitter 101 may beremovable from the continuous glucose sensor system 100 and reusablewith multiple sensors 103 as the sensors 103 are replaced. Further, thecontinuous glucose sensor system 100 can include other components tofacilitate data communications. For example, the continuous glucosesensor system 100 may include wired ports, such as a USB port, Ethernetport, and others, for communicating with other devices and providingdata relating to glucose levels. The continuous glucose sensor system100 may include the processing circuitry, such as a processor, memory,and a battery, as part of the sensor electronics. The sensor electronicsmay be included in the continuous glucose sensor system 100 or thetransmitter 101. The sensor portion 103 of the continuous glucose sensorsystem 100 may be removable and replaceable, allowing a patient tochange to a new sensor periodically, such as every week. Similarly, thetransmitter 101 may detach and be removable from the continuous glucosesensor system 100, allowing replacement as needed, such as every sixmonths.

Continuous glucose sensor system 100 may obtain samples at predeterminedintervals, such as every few seconds, every thirty seconds, everyminute, or on demand in response to a command from a user. In oneembodiment, the wireless transmitter can be turned off to conservebattery life, and measurements taken over a period of time can bewirelessly transmitted to dedicated display 104 a and display 106 a in abatch transfer. For example, the continuous glucose sensor system 100can wake up the wireless transmitter every five minutes, transfer datarelating to glucose measurements taken over the last five minutes, andtransfer the data to the dedicated display 104 a and display 106 a. Thewireless transmitter 101 can then be turned off again to conservebattery life. While an example of transferring data every five minuteshas been provided, it will be appreciated that longer or shorter timeperiods can be used, and the time period can be configured by a user viadedicated display 104 a or display 106 a.

The system of FIG. 1 may have a state determined by the continuousglucose sensor system 100 and its transmitter 101. One exemplary systemstate includes not started, such as when a sensor 103 has not yet beeninserted into the host or when the user has not yet activated thecontinuous glucose sensor system 100. Another example is a sensorwarm-up period, which may last for a period of time, such as two hours,when the sensor 103 is warming up and acclimating to insertion in theuser's body. The sensor warm-up state may also include a calibrationperiod. Other examples of system states include in calibration or out ofcalibration. A sensor 103 and/or continuous glucose sensor system 100may be in calibration when it has been calibrated within a predeterminedinterval, such as within the last twelve hours, and out of calibrationif a predetermined duration (e.g. twelve hours) has passed since thelast calibration. Another exemplary system state is sensor stopped. Thesensor stopped state may occur, for example, when a user seeks toreplace the sensor portion 103 of the glucose sensor system 100.

The system of FIG. 1 coordinates communication among continuous glucosesensor system 100, dedicated display 104 a, and display 106 a to ensureconsistent operations. The continuous glucose sensor system 100 mayadvertise and communicate with the displays in communication periodsthat occur at intervals. Advertising is a process of the continuousglucose sensor system 100 broadcasting its presence to look for otherdevices to connect with. Optionally, the communication intervals mayoccur about every five minutes (for instance, the communication intervalmay last 30 seconds, so the interval would occur four and a half minutesafter the end of each communication interval). During the communicationinterval, the continuous glucose sensor system 100 may exchange datarelating to glucose levels, system configuration information, systemstatus information, patient identifying information, and otherinformation with the displays. The displays may receive these datatransmissions and also send commands to the continuous glucose sensorsystem 100. The transmitter 101 in the continuous glucose sensor system100 may update the system state in response to a command and transmit amessage with the updated system state to the connected displays.

There is a possibility of mismatched values being displayed by the twodisplays in the situation where one display has already communicatedduring a communication interval, and then the second display updatescalibration values. In this example, the first display will continue topresent to a user the old values based on the prior calibration until itis updated during the next communication interval. To illustrate, a usermay enter a command, such as a calibration command, into display 106 a,and that command will be sent to the continuous glucose sensor system100 during the next communication interval. If in the next communicationinterval, the continuous glucose sensor system 100 first communicateswith dedicated display 104 a by providing, for example, data relating toglucose levels over the last five minutes, the dedicated display 104 awill present that glucose data to the user. However, if the continuousglucose sensor system 100 next communicates with display 106 a andreceives a calibration command, the continuous glucose sensor system 100may then calculate new glucose levels. This can lead to mismatchedvalues being displayed on dedicated display 104 a and display 106 a.Other scenarios also include starting or stopping a sensor when a userwants to replace the sensor. As a result, the system of FIG. 1 maycoordinate the transmission of commands and data relating to glucoselevels among continuous glucose sensor system 100, dedicated display 104a, and display 106 a to ensure consistent operation. Exemplaryembodiments will be described in more detail below in, for example,FIGS. 11, 12, and 17.

The data transmitted from continuous glucose sensor system 100 todedicated display 104 a and display 106 a may be any type of datarelating to monitoring glucose values. For example, the continuousglucose sensor system 100 may exchange calibration data with dedicateddisplay 104 a and 106 a on initial startup and periodically thereafterto maintain accuracy of the glucose measurements. A user may measuretheir glucose level using a blood glucose meter, enter the valuedisplayed by the meter, and that value may be used to calibrate thecontinuous glucose sensor system 100. Multiple samples from a bloodglucose meter may be used to promote accuracy and proper calibration.Other examples of transmitted data include an amount of current orvoltage measured by continuous glucose sensor, a converted glucose valuein, for example, mg/dL, and a timestamp associated with the time wheneach measurement or value was sampled, diagnostic data, and the like.Although described as a continuous glucose sensor system 100, othermedical devices may be used with the disclosed embodiments. For example,the continuous glucose sensor system 100 may an analyte sensor and thetransmitted data may reflect analyte values.

Dedicated display 104 a may be a display dedicated to use withcontinuous glucose sensor system 100. The combination of the continuousglucose sensor system 100 and dedicated display 104 a may, in oneembodiment, be approved medical devices, such as a class III medicaldevice. Dedicated display 104 a may receive data relating to glucoselevels from continuous glucose sensor system 100 in real-time, whichincludes both continuous streaming of data and batched datatransmission.

Because dedicated display 104 a is part of an approved medical devicewith continuous glucose sensor system 100, dedicated display 104 a may,in one embodiment, receive and display the enhanced set of data receivedfrom continuous glucose sensor system 100 relative to other displays orthird-party applications or system components. For example, dedicateddisplay 104 a can display actual glucose levels associated withmeasurements taken by the sensor. In contrast, third-party applicationsexecuting on display 106 a may be restricted from receiving anddisplaying actual glucose levels and instead may receive a more genericindicator of glucose levels, such as whether glucose levels are low,normal, or high. Additional details regarding the types of data that canbe sent to and displayed by dedicated display 104 a and display 106 awill be provided below.

Dedicated display 104 a may include a processor for calculating glucoselevels based on received measurements, memory for storing glucoselevels, ports for wired communications, and wireless communicationcircuits, such as Bluetooth, WiFi, and RF circuits. In addition,dedicated display 104 a can determine a historical trend of whether auser's glucose levels are trending down, remaining stable, orincreasing. As shown in FIG. 1, dedicated display 104 a can presentglucose readings over time so a user can easily monitor glucose levels,and can also display an actual value of the current glucose level. Inthe example of FIG. 1, dedicated display 104 a illustrates that thecurrent glucose level is 94 mg/dL.

Display 106 a can be any type of display associated with a personalcomputer, tablet, or smart phone that can execute applications fordisplaying data relating to glucose levels. As a result, display 106 aincludes all of the hardware components associated with personalcomputing devices, including processor(s), memory, wireless connections,a USB port, and others.

Both dedicated display 104 a and display 106 a can establish alarms toalert a user to glucose conditions. As examples, a user-perceptiblealert may trigger when glucose levels are too low (e.g., below 55mg/dL), at a level defined by the user as low (e.g., a value set between55 mg/dL and 70 mg/dL), too high, above a level defined by a user,trending down too fast, and trending up too fast. Each display may usethe same or different alert values. In addition, alerts can be used toprompt a user to perform a function, such as perform a calibration byentering blood glucose values taken using a separate measurement device.The calibration values can be sent from the display device to thetransmitter and used to calibrate glucose data sampled by the continuousglucose sensor system 100.

Alerts can also be sent from the glucose sensor 100 via wirelesstransmitter to the displays. The alerts can indicate an error with thesensor, a warning that the sensor 103 will expire soon and should bereplaced, and an error indicating that a sensor 103 has expired. Anotheralert that can be sent from the continuous glucose sensor system 100 canindicate that a transmitter battery is low, there is a weak wirelesssignal between the continuous glucose sensor transmitter 101 and adisplay, failure in the pairing or authentication process, and otheralerts relating to system operation and use. The alerts can be displayedto a user with increasing frequency until one or both of the useracknowledging the alert and the underlying alert condition is resolved.

Display 106 a may execute a plurality of applications 108˜110 thatrelate to glucose monitoring, receiving and displaying various types ofhealth information, including exercise activity, controlling andmonitoring insulin injections, eating habits, and others. In oneembodiment, display 106 a receives the same data that continuous glucosesensor system 100 transmits to dedicated display 104 a. Display 106 amay include a dedicated application 108 created, in one exemplaryembodiment, by the manufacturer or an affiliate of the continuousglucose sensor system 100. The dedicated application 108, display 106 a,and/or continuous glucose sensor system 100 may be approved medicaldevices. For example, in one embodiment, continuous glucose sensorsystem 100, display 106 a, and dedicated application 108, alone or incombination, are approved class III medical devices. The dedicatedapplication 108 may control the distribution of medical data receivedfrom the continuous glucose sensor system 100 to other applicationsexecuting on display 106 a to preserve confidentiality and userpreferences, as described in more detail below. Although notillustrated, dedicated application 108 and approved third partyapplication 110 may also be connected to and provide information toother applications on display 106 a or transmitted to further computingdevices and/or server systems.

An approved third-party application 110 may also receive data relatingto blood glucose levels. The dedicated application 108 may receiveglucose data from continuous glucose sensor system 100, determine whatset of data should be provided to an approved third-party application110, and provide the data to the third-party application 110. A user mayconfigure what types of medical data the dedicated application 108should provide to the approved third-party application 110. In thismanner, the third-party application may receive the same data receivedby dedicated application 108, a reduced set of data, or encrypted data.While dedicated application 108 has been described as controlling whatdata is provided to third-party application 110, an operating systemexecuting on display 106 a or other software program may also separatethe data received from continuous glucose sensor system 100 and provideit, as appropriate, to applications 108, 110.

FIG. 1 also illustrates an additional dedicated display 104 b and anadditional display 106 b. These devices may be additional devices thatare within a wireless transmission range from continuous glucose sensorsystem 100. For example, a user may be at a conference or in a publicarea where many people have a continuous glucose sensor system 100,dedicated display 104 a, and display 106 a. Displays 104 b, 106 b thatare connected to another continuous glucose sensor system should not beallowed to connect to continuous glucose sensor system 100. This couldcause incorrect data to be displayed from another user and also wouldconstitute a breach of security for medical data. As a result, in oneembodiment, each continuous glucose sensor system 100 may limit thenumber of devices that it connects with, and only connect with paired,authenticated devices in a secure fashion. For example, the continuousglucose sensor system 100 may connect to only a single dedicated display104 a and display 106 a at a given time. Limiting the number of deviceswith which the continuous glucose sensor system 100 can communicateduring a particular session also saves battery life of the sensor 100.Additional details including exemplary techniques for limiting thenumber of devices with which a continuous glucose sensor system 100 canconnect at a given time will be provided below with regard to, forexample, the embodiments of FIGS. 2, 6-8, 11, 14, and 15.

In addition to limiting the number of devices, the system may alsoemploy security measures to keep medical data private. The securitymeasures can include one-way authentication, two-way authentication,encryption, hashing, and security keys. The encryption employed may bein addition to encryption already offered by wireless standards, such asBluetooth encryption. One problem that arises is with repeated attemptsto attack the security of devices by an unauthorized third-partyguessing the security key. To combat this problem, in one embodiment, anapplication key can be exchanged between continuous glucose sensorsystem 100, dedicated display 104 a, and display 106 a, and theapplication key can change periodically. For example, the applicationkey can change on demand, at predetermined time intervals, in responseto a certain event, and in other situations. The term periodicallytherefore is not limited to defined time intervals but instead relatesto periods within which communications are secured using an applicationkey that can change during another communication period.

FIG. 2 is a flow chart of an exemplary method for connecting multipledisplay devices and securing wireless communications. In the method ofFIG. 2, the number of display devices that are connected to a continuousglucose sensor system 100 can be limited to, for example, two displaydevices. In one embodiment, each display device may be of a differenttype, such as a dedicated display 104 a and a display 106 a, although inother embodiments both display devices may be of the same type.

At step 200, the continuous glucose sensor system 100 may connect withthe first display device. The connection used may include a variety ofdifferent techniques to authenticate and pair the continuous glucosesensor system 100 with the first display device. Exemplary embodimentsfor authenticating and pairing the continuous glucose sensor system 100with a display device will be described below.

At step 202, the continuous glucose sensor system 100 may connect withthe second display device. As with the connection to the first displaydevice, the connection used may include a variety of differenttechniques to authenticate and pair the continuous glucose sensor system100 with the first display device. The type of wireless connectionbetween the continuous glucose sensor system 100 and the first displaydevice need not be the same type of connection as between the continuousglucose sensor system 100 and the second display device. For example,the continuous glucose sensor system 100 may connect with the firstdisplay device using a RF connection and with the second display deviceusing a connection, such as a Bluetooth connection.

Next, at step 204, the number of connections may be limited to the firstdisplay device and the second display device in a particularcommunication interval. For example, the continuous glucose sensorsystem 100 may be limited to connecting with two display devices at atime to conserve battery life and avoid widespread transmission ofsensitive medical data. More than two devices may be authenticated fortransmission in the situation where a user has, for example, multiplesmart phones, a tablet, a laptop, or a personal computer, each of whichmay act as a display 106 a. However, the number of displays that can beconnected at a given time may be limited to conserve battery life of thecontinuous glucose sensor system 100.

In one embodiment, the described methods for authenticating between acontinuous glucose sensor system 100 and a display may occur at eachcommunication interval (e.g., every five minutes). The transmitter mayinform each display if communications are allowed. Once one device of agiven type has been allowed in a communication interval, other devicesmay be rejected that respond to advertising and have the same devicetype as the already allowed device.

A variety of different techniques may be used to limit the number ofdevices. As examples, the continuous glucose sensor system 100 may allowonly a single device of given type (e.g., a dedicated display 104 a anddisplay 106 a). Lists can be stored in memory of the continuous glucosesensor system 100 to track which device types have connected to thecontinuous glucose sensor system 100, and a combination of hardwarelevel and software level identification and authentication can be used.An exemplary embodiment with additional details of limiting the numberof devices will be provided below.

After pairing devices, a user may also enter a prompt through a displayto switch to another device. In one embodiment, the user may be activelycommunicating with the continuous glucose sensor system 100 using adedicated display and a smart phone and may want to switch to using thededicated display and a tablet. The user may enter a command through auser interface on any of the smart phone, the dedicated display, or thetablet to request the switch. In response, the continuous glucose sensorsystem 100 may cease transmissions to the smart phone and begintransmissions with the tablet, after appropriate authentication,pairing, and security measures are in place, as described in detailbelow.

At step 206, the continuous glucose sensor system 100 may exchange anapplication key with the connected display devices. Step 206 is anoptional step that occurs in some embodiments. Communications mayinitially be established using a fixed key. The fixed key can be basedon a transmitter identifier or a portion of a transmitter identifierprinted on the continuous glucose sensor system 100 or transmitter 101.The user may enter the transmitter identifier into the dedicated display104 a and display 106 a to establish communications. The transmitteridentifier may also be sent from continuous glucose sensor system 100 tothe dedicated display 104 a and display 106 a, so that a comparison canbe made between the transmitter identifier received from the continuousglucose sensor system 100 and the transmitter identifier entered by auser. When the transmitter identifiers match, communications may beallowed, or additional security steps may occur to further authenticatethe two devices. When the transmitter identifiers do not match, therequested connection may be denied.

Although described as using a transmitter identifier throughout thespecification to establish secure communications, the transmitter 101may also include any other type of identifier stored in memory from thefactory. For example, a secure identifier and/or key can be stored innonvolatile memory prior to initial sale. A user could then download theinformation needed to perform authentication by their phone, such as acopy of the secure identifier or key, over the internet using thetransmitter identifier. An online database may store the decryptinginformation for each transmitter identifier to provide that informationto a user's display during to the pairing process.

As an additional security measure, the continuous glucose sensor system100 may transmit a separate application key to the connected displays.The application key may remain active for an interval, which may bedefined by a period of time, events, or based on other activities orinactivity. An exemplary time interval for using an application key isfour hours. Exemplary events include a display going offline orattempting to reconnect. In one embodiment, the dedicated display 104 aand display 106 a may use the same application key, although in otherembodiments each display may use a different application key for securecommunications.

Reference will now turn to FIG. 3, which illustrates an exemplary methodfor determining whether to allow a connection. The method of FIG. 3illustrates an exemplary implementation for connecting a display atsteps 200 and/or 202 in FIG. 2. In one embodiment, a connection may beallowed when the continuous glucose sensor system 100 and the displayhave exchanged identifying information. In the example of FIG. 3, theidentifying information may include a transmitter identifier that isprinted on the back of the continuous glucose sensor system 100 ortransmitter 101. However, transmitting the transmitter identifier itselfcan lead to a security breach by unauthorized devices nearby that canlisten or sniff for transmissions. The unauthorized devices can listenfor transmissions from the continuous glucose sensor system 100, obtainthe transmitter identifier, and then enter the same value on anotherdisplay in an effort to circumvent security. The method of FIG. 3therefore adds an additional layer of security by using a hashingalgorithm on the transmitter identifier so that unauthorized displayscannot pretend to be an authorized display by listening for thetransmitter identifier.

At step 300, a display may receive a first identifier. For example, auser may look on the back of a continuous glucose sensor system 100 andfind a transmitter identifier printed on the back of the sensor system100 or transmitter 101. The display may prompt a user to enter thetransmitter identifier to begin the process of establishing aconnection.

At step 302, the display may create a first hashed value from the firsttransmitter identifier. Any type of hash function may be used to createa hashed value. A hashing function is used to map data of a given lengthinto a different length. As an example, a nine digit transmitteridentifier may be entered by a user. The hashed value may include thelast four digits of the transmitter value. In other embodiments, thehashed value may be a translation of any of the digits, so that acombination such as 123456789 becomes ABF after executing the hashingalgorithm. It will be appreciated that a wide variety of hashingalgorithms exist and can be used to translate data into a differentform.

A display may receive an advertisement signal from the continuousglucose sensor system 100 at step 304. An advertisement signal is asignal used in the pairing process where a device transmits a messageadvertising its availability for a connection. In one embodiment, theadvertising period may last for a defined time interval, such as sevenseconds, and may repeat for up to a defined number of iterations in agiven communication interval. For example, two advertising periods ofseven seconds each may be used at five minute communication intervals.The advertising periods may also have different durations based on thetype of device, such as four seconds to pair displays and two seconds topair a dedicated display 104 a.

The user may place their display into an advertising mode that causesthe display to scan for any advertising signals. This process may occur,for example, when a user inserts the transmitter into the continuousglucose sensor system 100 upon initial startup, or when a user wants toadd a new display to the system. The transmitter 101 on the continuousglucose sensor system 100 may broadcast an advertisement signal thatincludes a hashed version of the transmitter identifier. In thisembodiment, the transmitter identifier that is printed on the back ofthe continuous glucose sensor system 100 or transmitter 101 may also bestored in memory within the continuous glucose sensor. The hashingalgorithm may also be stored in memory by the continuous glucose sensorsystem 100, so that it can create a hashed value from the storedtransmitter identifier and send the hashed value to the display in theadvertisement signal.

After the initial connection between the continuous glucose sensorsystem 100 and a display, the display may enter a state where itsearches for advertisement signals automatically. In one embodiment,each communication interval by the transmitter involves the process ofreceiving advertising signals and performing authentication. The displaymay automatically enter a state to search for advertising signals byknowing that the transmitter will wake up and transmit advertisingsignals periodically. Therefore, the display need not continuouslysearch for advertising signals, allowing the display to conserve batterylife. In other embodiments, however, the display may remain in a stateof constantly monitoring for advertising signals by their dedicateddisplay 104 a or other display 106 a, such as a smartphone.

At step 306, the display will parse at least one of the advertisementsignal or signals associated with the advertisement signal to identifythe second hashed value. The second hashed value may be, in oneembodiment, the result of executing the hashing algorithm on thetransmitter identifier stored in memory by the continuous glucose sensorsystem 100. The second hashed value may be sent in the advertisementsignal itself. The advertising signal may include a payload with a shortname, flags, a unique user identifier, and manufacturing data. The shortname and unique user identifier, which may be, for example, 128 bits,may identify the transmitter. The manufacturing data field may containthe transmitter hashed value used for the authentication phase. Inanother embodiment, the second hashed valued may be sent in signalsassociated with the advertisement signal. For example, after receivingan advertisement signal and allowing a connection, the second hashedvalue may be sent either automatically or in response to a request.

The hashing algorithm can be either one-way, meaning the original valuecannot be obtained from the hashed value, or two-way, meaning the hashedvalue can be returned to the original transmitter identifier. Inaddition, hashing may include an AES 128 bit encryption with ElectronicCodeBook mode, another form of encryption, cryptography, and othertechniques to transform the transmitter identifier into a hashed value.As a result, in one embodiment, the transmitter identifier is nottransmitted in an advertising signal from the continuous glucose sensor.Instead, a hashed value can be sent. An unauthorized display thatreceives this hashed value cannot recreate the original transmitteridentifier, and therefore cannot improperly enter the transmitteridentifier into another display to gain unauthorized access. As anexample, a sixteen byte key may be created by repeating the first fourbytes of the transmitter identifier four times in sequence. The key mayoptionally be provided to an AES 128 bit algorithm using ElectronicCodeBook mode. Both the continuous glucose sensor system 100 and thedisplay may compute the key.

Next, the display may compare the first and second hashed values. In oneembodiment, the hashing algorithms may be designed so that a perfectmatch of the same characters results in a match. Continuing with theexample above, the display may create a key and compare it to the hashedvalue received in the advertising signal. In other embodiments, a matchoccurs even in the absence of the same characters being present in thefirst hashed value and the second hashed value. For example, if thefirst hashed value and the second hashed value differ by a predeterminedamount, then a match can be found. The first hashed value could be 123,and the second hashed value could be 456. Although the two do not matchin the sense of being the same series of characters, the hashingalgorithm can know that the first numerical entry in the second hashedvalue should be one greater than then last numerical entry in the firsthashed value. Many other examples are also possible.

The second hashed value also may be a key needed to reverse a hashingalgorithm. Instead of transmitting a hashed value of the transmitteridentifier, the second hashed value may be a key needed by theauthenticating device to reverse or decrypt an encrypted transmitteridentifier. A match can be found when the second hashed value can beused as a key to obtain the transmitter identifier. It will therefore beappreciated that the hashing algorithm executing on the display and thehashing algorithm executing on the continuous glucose sensor system 100need not be the same algorithms or create the same series of characters.Instead, the first and second hashing algorithms can be designed tocreate first and second hashed values that have a defined relationshipthat will result in a match.

In the situation where a match is not found, the connection may bedenied at step 310. However, where a match is found, the connection maybe allowed at step 312. In one embodiment, executing the method of FIG.3 may result in communications between the continuous glucose sensorsystem 100 and a display. However, executing step 312 to allow aconnection also includes embodiments where the process of fully pairingthe devices can continue on to further steps. That is, the result ofstep 312 can be a connection in the form of, for example, an unsecuredconnection. Additional steps may make the connection secure.

For example, in addition to hashing a transmitter identifier, awhitelist including allowed devices may be accessed, an application keymay be exchanged, encryption can be used, and additional steps may beincluded before communications can be exchanged between the continuousglucose sensor system 100 and a display. These additional steps aredescribed in the subsequent embodiments (e.g., FIGS. 4-8, and 13-15) andmay be used instead of, or in addition to, the exemplary method in FIG.3. In one embodiment, after step 312, a message may be displayed to auser that the continuous glucose sensor system 100 has been paired to adisplay alone or along with a message indicating that furtherauthentication may occur.

The method of FIG. 3 therefore allows a hashed value to be exchangedbetween the continuous glucose sensor system 100 and display for use inan authentication process. Hashed values can vary based on theparticular display that is requesting a connection. For example, asdescribed below, the type of each display can also be known andidentified in the system. The continuous glucose sensor system 100 mayuse a first hashing algorithm for a first type of display, and a secondhashing algorithm for a second type of display.

FIG. 4 illustrates an exemplary method for authenticating andestablishing communications between a continuous glucose sensor andmultiple displays, which may be part of steps 200 and 202 in FIG. 2. Theembodiment in FIG. 4 exchanges an application key to provide anadditional level of security before transmitting data relating toglucose levels from the continuous glucose sensor to the displays. Anapplication key may be created by software and updated periodically asdescribed below.

At step 400, a display may receive an advertisement signal from thecontinuous glucose sensor system 100 and then establish a connection atstep 402. The process of establishing a connection may also involvecomparing identifying information, such as a type of a device, to awhitelist stored in memory, as described in more detail below in, forexample, FIGS. 6, 7, and 13-15. In this example, Bluetoothcommunications can provide the advertising signal and step ofestablishing a connection.

Next, at steps 404 and 406, the first key may be received and comparedwith a second key. As with reference to FIG. 3, the first key may be ahashed version of a transmitter identifier, a key used to decrypt atransmitter identifier, or other information associated with encryptingand decrypting a transmitter identifier to avoid inappropriate misuse byan unauthorized device. The first key may be received at step 404 inresponse to a request sent from the display to the continuous glucosesensor system 100 upon establishing a connection. In other embodiments,the display may receive the first key automatically upon establishing aconnection or in advertising signals.

The process of checking for a match between the first hashed value andthe second hashed value can occur on the continuous glucose sensor orthe display. After the advertisement period and establishing aconnection, the first key may be sent in response to a request includinga challenge value. The challenge value may be used to encrypt thetransmitter identifier or executing a hashing algorithm on thetransmitter identifier to create the first key.

At step 406, the first key may be compared to a second key. As describedpreviously, a match may be found in a variety of circumstances where apredefined relationship is found to exist between the first key and thesecond key. If the comparison results in a match between the first andsecond key, the continuous glucose sensor system 100 and the display maybe authenticated at step 408.

Next, at step 410, an application key may be exchanged between thecontinuous glucose sensor system 100 and the displays. In the embodimentof FIG. 4, beyond exchanging a key between the continuous glucose sensorsystem 100 and display, an application key may also be used to providesecure communications. In one embodiment, the transmitter identifier maybe printed on the back of a transmitter 101. As a result, anunauthorized user may view the transmitter identifier and use thatinformation to improperly authenticate their display. In addition,because the transmitter identifier may, in one embodiment, remain thesame, users who try to sniff communications have additionalopportunities over time to attempt to circumvent hashing or encryptionof the transmitter identifier. Adding an additional application keyprovides additional security and the ability to periodically change thekey to ensure continued secure communications.

The application key may be sent either from the continuous glucosesensor system 100 to the display, or from the display to the continuousglucose sensor system 100. The device receiving the application key mayprovide an acknowledgment that it has accepted the application key atstep 412. In some embodiments, the receiving device may not acknowledgethe application key due to an error in the communication. For example,in the embodiment where a display sends the application key to atransmitter, the display may be out of wireless range from thetransmitter 101. As another example, the transmitter 101 may havereceived the application key and transmitted an acknowledgment back tothe display, but the display may not have received the acknowledgment.In the example where an acknowledgment is not received, the display canoperate according to several optional embodiments.

In one option, the display may discontinue communications and attempt toresend the application key. In this embodiment, steps 410 and 412 mayrepeat until successful acknowledgment of the application key isreceived. In another embodiment, the display may switch to using theapplication key even without receiving the acknowledgment. Ifcommunications succeed and the display receives responses to commandsbased on the application key, the display may continue with using theapplication key despite not receiving an acknowledgment. The displayinstead has confirmed receipt of the application key through thesubsequent successful communications, indicating the responseacknowledgement message was dropped or experienced a communicationerror. Another option for handling the situation where an acknowledgmentis not received is to continue using any prior application key. Thedisplay in this embodiment may maintain both application keys—the priorkey and the key that was not acknowledged—until an acknowledgment isreceived or a new communication interval begins. In addition, thedisplay may repeat step 410 by sending the application key again untilacknowledgement is received.

Once acknowledgment has been received, communications between thecontinuous glucose sensor system 100 and the display may be allowed anddata relating to glucose levels may be transmitted from the continuousglucose sensor system 100 to the display. The process in FIG. 4 mayrepeat for each display that connects with the continuous glucose sensorsystem 100. The connection process may proceed concurrently between thecontinuous glucose sensor system 100 and a plurality of displays or insequence. In addition, the application key need not be the same for eachdisplay. In one embodiment, each pair of display and continuous glucosesensor system 100 may use different application keys.

Reference will now turn to FIG. 5, which illustrates an exemplary methodfor updating an application key. The method illustrated in FIG. 5 may beused in addition to the method of FIG. 4, as well as in otherembodiments. By updating the application key periodically, security canbe enhanced and repeated attempts to access transmission of securemedical data can be defeated.

At step 500, the continuous glucose sensor system 100 and display maywait for a period of time or until an activity occurs. During the periodof waiting, the current application key may be used to securecommunications between the continuous glucose sensor system 100 and thedisplay. The process of switching to a new application key may occur atdefined time intervals, such as hourly, or when a particular activityoccurs. Examples of activities that can trigger exchange of a newapplication key include a display going offline and then coming backonline (e.g., a display losing its network connection with thecontinuous glucose sensor system 100 and then reestablishing aconnection), a user switching to a new display, rejection of an attemptby another display to connect with the continuous glucose sensor system100, and others.

At step 502, the display or continuous glucose sensor system 100 maycreate a new application key. In the embodiment of the displaytransmitting the new application key to the continuous glucose sensorsystem 100, the display may create the new application key. The key maybe created prior to step 500, during the waiting period, or upondetecting the period of time or activity in step 500.

The new application key may be transmitted to the receiving device atstep 504. For example, the display may transmit the new application keyto the continuous glucose sensor system 100. Next, an acknowledgmentindicating the new application key was accepted may be received at step506. As with the embodiment of FIG. 4, various techniques may beemployed for handling the situation where an acknowledgment of the newapplication key is not received. The techniques described with referenceto FIG. 4 therefore apply equally to switching to a new application key.

Once acceptance has been received, further communications can occur atstep 508. In one embodiment, as described previously, furthercommunications may occur even without receiving an acknowledgment bycontinuing to use the prior key. This allows seamless operation for auser while the process of FIG. 5 repeats to successfully update theapplication key. FIG. 5 may repeat at step 510, for example, atpredetermined time intervals, upon detection of an activity, and whensuccessful acknowledgment of the new key is not received.

Another issue that arises relates both to conserving battery life andlimiting the number of display devices that can connect to thecontinuous glucose sensor system 100 at a given time. Having too manydevices connected at once places increased burdens on the battery liftof the continuous glucose sensor 100 as it must communicate with manydevices, which reduces the periods in which the continuous glucosesensor 100 can enter a low-power sleep state. FIG. 6 illustrates anexemplary method for connecting a continuous glucose sensor to one ormore displays based on a device type. FIG. 6 is one example of limitingconnections, as described with reference to step 204 in FIG. 2.

The continuous glucose sensor system 100 can be a small device worn onthe body of a user that is powered by a battery. As a result, conservingbattery life may be an important consideration for providing a systemthat can continuously monitor glucose levels. Each data transmissionbetween a continuous glucose sensor system 100 and a display consumesbattery life. To conserve battery life, the transmitter 101 on thecontinuous glucose sensor system 100 may be placed in a sleep state andbrought into an active state periodically, such as on a time interval ofevery five minutes. In addition, the continuous glucose sensor system100 itself may be placed in a sleep state and periodically activated. Asan additional measure to conserve battery life, in one embodiment, thenumber of displays with which the continuous glucose sensor system 100exchanges data and commands can be limited. FIG. 6 illustrates anexemplary method for limiting the number of devices that connect to acontinuous glucose sensor system 100 based on a type of device.

At step 600, the continuous glucose sensor may receive a request to pairwith a first device type. For example, the dedicated display 104 a mayrequest a connection with the continuous glucose sensor system 100. Inone embodiment, the request may come as part of an advertising andconnect process as previously described. The request may include anindication of the type of device that seeks a connection with thecontinuous glucose sensor system 100. The device type may be included inthe message, or the device type may be determined by the continuousglucose sensor system 100 based on other information included in orassociated with the request. For example, a device type identifier maybe used to determine the device type, or a user may provide an input tothe display indicating the type of device, such as a tablet, personalcomputer, or smart phone.

The continuous glucose sensor may store a first list of devices andtheir associated device types in memory. The first list may initially beempty, and as new devices are paired, authenticated, and connected, thedevice may be added to the first list in memory. The first list can be awhite list, which is a hardware level list allowed device types. Deviceshaving an unrecognized device type may be denied requests forconnections. Upon receiving a request indicating the first type ofdevice requesting a connection, the continuous glucose sensor system 100may compare the first type of device with the first list stored inmemory at step 602. The continuous glucose sensor system 100 maydetermine if a device having the first type is already included in thefirst list at 604. If the device having a given device type (e.g.,dedicated display or other display) is not on the first list, and thedevice type is recognized, that device may be added to the first list atstep 606 to allow pairing. If the device is already on the first list,then the method may continue on to step 608.

If another device having the requesting device type is already includedin the first list, the continuous glucose sensor system 100 maydetermine if a maximum number of devices having that device type arealready included in the first list. For example, the first list mayallow for a certain number of entries of each device having a giventype, such as one device, two devices, five devices, or any other numberbased on the size of memory and other system considerations. The processin steps 600˜606 may repeat for additional devices seeking a connectionwith the continuous glucose sensor system 100. In one embodiment, asingle dedicated display 104 a and a single display 106 a of anothertype may be connected to the continuous glucose sensor system 100.

In addition, the advertising period may vary based on the number ofdevices in the first list. In one embodiment, a single advertisementperiod may be used if the first list is empty and no displays haveauthenticated. If a display responds during the advertising period, butthe connection is rejected, the advertising period can continue for itsremaining duration. In the example where at least one display is alreadyincluded in the first list, two advertising periods can be used. If adisplay is rejected and the advertising period in which the display wasrejected still has time left, the continuous glucose sensor system 100can continue to advertise for the remaining period of time. Optionally,where one display is included in the first list, the second advertisingperiod may not use a comparison to determine if the requesting devicetype is included in the first list. In the embodiment where the firstlist is full, such as where the first list includes a device of a devicetype as a dedicated display and a device of the device type as anotherdisplay, the filter using the first list can be active during twoadvertising periods.

At step 608, the continuous glucose sensor system 100 may proceed withdetermining if bonding information is included in a second list. Whilethe first list contains a list of devices that can proceed with theadvertising and pairing process, the second list may be, in oneembodiment, a software-level list that contains the bonding informationresulting from a successful pairing between the continuous glucosesensor system 100 and a display. The first list and the second list maybe stored in non-volatile memory. As a result, if the display requestinga connection has previously paired and connected with the continuousglucose sensor system 100, its bonding information can be stored by thecontinuous glucose sensor system 100 in a second list. By storingbonding information, the next time a device requests a connection theconnection process can proceed without delay.

The bonding information may include, in one embodiment, information usedto establish a connection. In addition, the bonding information mayinclude additional authentication information, such as a transmitteridentifier, hashed transmitter identifier, encryption or decryptionkeys, the current application key, and a prior application key. If thebonding information is already included in the second list for thedevice requesting a connection, the connection may be established at610, allowing transmission of commands from the display to thecontinuous glucose sensor system 100 and data relating to glucose valuesfrom the continuous glucose sensor to the display.

If, however, the bonding information for a display requesting aconnection is not included in the second list, the pairing process mayproceed to include the steps required to establish the given type ofconnection. For example, a pairing process can occur at step 612, whichcan include any of the previously described embodiments.

FIG. 7 illustrates an exemplary system diagram of storing connectioninformation. As described with reference to FIG. 1, a continuous glucosesensor system 100 may wirelessly connect with a dedicated display 104and display 106. The continuous glucose sensor system 100 may includememory 700 for storing various information used to implement thedisclosed embodiments. A whitelist 702, also referred to in someembodiments as a first list, may include a list of devices types thatare allowed to connect with the continuous glucose sensor system 100.

As illustrated, the list may include two columns for each type ofdevice, one column for dedicated displays 104 a and another for otherdisplays 106 a. In other embodiments, additional columns may be includedand the device types may be further refined. For example, instead of acategory for devices having a type of a display, each specific type ofdisplay may be separately stored, such as a tablet, personal computer,laptop, or smart phone. In addition, while described as a first list andillustrated as a table, it will be appreciated that the allowed devicetypes may be stored in a variety of other fashions, including adatabase. In the example shown in FIG. 7, whitelist 702 has previouslyregistered a dedicated display having a device identifier ID DISP1.

Continuous glucose sensor system 100 may also store bonding informationin a separate table 704 in memory 700. The bonding information mayinclude, for example, information used to pair and authenticate adisplay for communication with the continuous glucose sensor system 100.Bonding information may be stored for the displays that connect with thecontinuous glucose sensor system 100 and may be maintained in memorypersistently for future reconnections.

In one embodiment, dedicated display 104 may also include memory 706 forstoring bonding information 708 and, for example, an application key710. The stored application key may include both the current applicationkey and a previous application key. Likewise, display 106 can includememory 712 with bonding information 708 and any application keys 710.

FIG. 8 illustrates an exemplary method for removing displays fromauthorized lists of displays. After devices have been added to thewhitelist and bonding information has been stored, a user may also wantto remove a device from the whitelist or remove bonding information. Forexample, a user may want to wipe clean all devices from memory or removea single device when the user has replaced their smart phone. Inaddition, there is a problem that a user might lose or break a displaydevice and not be able to remove the display device from the list ofauthorized displays. The method of FIG. 8 provides an example of a wayin which old display devices can be periodically removed from thewhitelist when they have not recently communicated with the transmitter101, which can indicate that a user no longer uses that display device.

At step 800, the system may receive a request to remove a device fromthe list of authorized displays. For example, a user may use theircurrent smart phone to indicate that they want to remove that smartphone prior to adding a new display. The request may be entered througha user interface on the display, and transmitted to the continuousglucose sensor system 100. The continuous glucose sensor system 100receives the request to remove the device from its list of authorizeddisplays. In other embodiments, a user may provide an input to remove adisplay from a device other than the display being removed. For example,the continuous glucose sensor system 100 may provide a list ofauthorized devices to the dedicated display. The user could then providea command from the dedicated display to remove a different display, suchas a smart phone. In this manner, the dedicated display can be used toremove and replace a lost smart phone or other display. Similarly,another display could be used to provide a command to remove and replacea dedicated display, allowing replacement of the dedicated display whenit is lost or malfunctioning.

Step 800 may also be performed automatically without any request from auser. In one embodiment, a display may be removed from the list if ithas not connected to the continuous glucose sensor system 100 for agiven period of time and/or connection intervals. As an example, adisplay that has not connected to the continuous glucose sensor in thepast 15 minutes, 30 minutes, hour, day or two weeks may be removed fromthe first list. As another example, a display that has not connected tothe continuous glucose sensor in the prior given number of communicationintervals, such as two, three or four may be removed from the firstlist. Note that in some embodiments, the prior bonding information canbe retained in the second list, however, to facilitate quickreconnection at a later time, without needing user input. The process ofautomatically removing displays that have not connected in a period oftime may be used concurrently with allowing a user to request removal ofa device discussed above.

At step 802, the continuous glucose sensor system 100 may remove thedevice from its first list. In one embodiment, the display to be removedcan be removed from the whitelist. Alternatively or additionally, thedisplay may also be removed from the second list containing bondinginformation. In one embodiment, however, a display may be removed fromthe whitelist but its bonding information may be maintained in thesecond list to facilitate reconnecting the removed display at a latertime. The device may store up to a certain number of display devices,such as five, with devices having recent communications being placed atthe top of the list and devices having older communications or havingceased communications being placed at the bottom of the list. As a newdevice needs to be added to the list (described below), an old devicethat has not had recent communications relative to the other devices onthe list can be removed to create a space for the new device. Thecontinuous glucose sensor system 100 may also transmit a message to thededicated display and display to indicate that a particular deviceshould be removed from the list of authorized devices.

Next, at step 804, a new device may be authenticated that has the samedevice type as the removed device. Of course, in previously describedembodiments, devices of a different type may be added at any time up toa maximum number of devices of the different type. However, if thewhitelist is full and no more devices of a given type can be stored, auser may want to remove an old device from the list and replace it witha new device having the same type. One example is a user upgrading theirtablet and replacing with a new device. The request may come from, forexample, the new device and may trigger the previously describedauthentication and pairing processes.

At step 806, the new device may be added to the whitelist using thetechniques previously described. In addition, the new device maycomplete the authentication and pairing process so that bondinginformation can be stored in the second list.

FIG. 9 illustrates an exemplary method for updating data in response toa command. A system with a continuous glucose sensor system 100 thattransmits data to multiple displays may cause synchronization challengesassociated with presenting data relating to glucose levels. A userexpects to see the same glucose levels displayed on each of thededicated display 104 a and the display 106 a since both displays derivetheir data from the same continuous glucose sensor system 100. However,each display can also provide commands to the continuous glucose sensorsystem 100 that can change the glucose data. For example, either displaymay send a command to start a sensor 103 when a user has replaced theirsensor 103. In one embodiment, a command to start a sensor 103 can causethe continuous glucose sensor to enter a warm-up phase during whichcalibration levels are entered to ensure accuracy. As another example,either display may transmit a command to the continuous glucose sensorsystem 100 to stop a sensor 103 before removing it or when the sensor103 needs to be taken offline. Another example includes sending acalibration command from a display to the continuous glucose sensorsystem 100.

Because, in some embodiments, the transmitter 101 on a continuousglucose sensor system 100 may be active intermittently, such as everyfive minutes, the command may not be immediately received by thecontinuous glucose sensor system 100. The user expects to receive anindication that the command has received immediately. In addition, whenthe continuous glucose sensor system 100 enters an active state, it mayprocess commands from the display that did not send the command first.As a result, the display that did not send a command may receive glucosevalues from the last five minutes, but then the second display may senda command to stop the continuous glucose sensor system 100 or use newcalibration values. Once that command has been processed, the seconddisplay will show the new glucose values based on the new calibration orwill display a different sensor state, such as offline, even while theother display continues to show an outdated glucose level or sensorstatus. This can cause one display to show outdated data compared to adisplay that sent a command until the next period when the continuousglucose sensor becomes active and sends the updated glucose levels orsensor status to both displays. FIGS. 9-11 illustrate exemplaryembodiments for updating both displays in response to commands.

At step 900, the transmitter 101 on a continuous glucose sensor system100 may enter an idle state. The idle state may last for five minutes inone embodiment. During the idle time, a display may receive a command atstep 902. Commands may be placed in a queue and sent to the continuousglucose sensor system 100 in a batch transfer when it resumes an activestate. However, the display may be placed in an intermediate state inthe meantime to provide confirmation to a user that the command has beenreceived. For example, a user may enter a command to stop a sensor 103.Because the command may not be sent while the transmitter for thecontinuous glucose sensor system 100 is in an idle state, the displaymay continue to show an active status for the sensor 103 even after thecommand to stop the sensor 103 has been entered by a user.

The display may therefore be placed in an intermediate state at step904, such as by displaying an indication that the command has beenreceived and is being processed. In addition, the display may illustratean exemplary time at which the command will be complete based on thetime remaining until when the transmitter will resume an active state.FIG. 10A illustrates an exemplary user interface in an intermediatestate. As shown at 1000, a message may be displayed that a command wasreceived and calibration is pending. In this example, the command mayrequest recalibration, although a variety of other commands can also beused.

During the intermediate state before a new glucose value has beenreceived from the continuous glucose sensor system 100 based on the newcalibration, the display 106 a and/or dedicated display 104 a may alsodisplay a new glucose value based on the estimated new calibration. Onceprecise calibration has been completed with the continuous glucosesensor system 100, the updated values received from the transmitter 101may be used in place of the estimated values. While estimated values aredisplayed, the user may receive, as part of the intermediate statenotification, an indication that estimated values are being displayedand optionally that the estimated values will be updated whencalibration completes.

At step 906, the transmitter 101 on the continuous glucose sensor system100 may activate and the command may be sent from the display to thecontinuous glucose sensor system 100. The continuous glucose sensorsystem 100 may process the command and send a response back to thedisplay that sent the command at step 908. Next, at step 910, thedisplay may be removed from the intermediate state and the updated datamay be displayed. For example, as shown in FIG. 10B, a message 1002 canbe displayed indicating the command is complete and new data is shown.

FIG. 11 illustrates an exemplary method for updating multiple displaysin response to a command. At step 1100, one or more displays may connectto a transmitter on a continuous glucose sensor system 100 as previouslydescribed. At specified times, such as periodically when the transmitter101 enters an active state, commands may be allowed at step 1102. Thetransmitter 101 may then send glucose data during the active state toconnected displays at step 1104.

At step 1106, the display may receive a calibration command from a userand provide the calibration command to the continuous glucose sensorsystem 100 at a specified time. The specified time can be when thetransmitter 101 for the continuous glucose sensor system 100 enters anactive state. Upon receiving the calibration command, the continuousglucose sensor system 100 may perform the requested calibration andcalculated updated glucose values based on the new calibration at step1108. In one embodiment, either the dedicated display 104 a or thedisplay 106 a can provide the calibration command.

The calibration command may be provided by a user at any time.Alternatively, the calibration command may be provided in response to aprompt to the user. The continuous glucose sensor system 100 may recordthe last time that a calibration occurred and track when a definedamount of time has passed since a calibration. Upon passage of a certainamount of time, such as three weeks, the continuous glucose sensorsystem 100 may transmit a message to either the dedicated display,another display, or both prompting a user that it is time to performanother calibration. The continuous glucose sensor system 100 may alsosend a message prompting for calibration in response to detectinginsertion or otherwise use of a new sensor 103. The message promptingfor calibration may be considered an alarm, and the alarm may escalateover time. Ultimately, if the user does not perform a calibration, thecontinuous glucose sensor system 100 can transmit an error message tothe displays indicating that the sensor 103 is out of calibration andthe displayed values may not be accurate. In addition, glucose levelsmay stop being displayed until after successful calibration. In anotherembodiment, the display 106 a or dedicated display 104 a may track thelast time a calibration was performed and prompt a user to perform acalibration once a defined amount of time has passed.

Next, the continuous glucose sensor system 100 may transmit the datarelating to glucose levels based on the new calibration to both thedisplay that requested a calibration and any other connected displays atstep 1110. This transmission may occur even if a display has alreadyreceived updated data relating to glucose levels in this communicationinterval. The data previously transmitted during a communicationinterval may be stored in addition to the new data, although, in oneembodiment, the new data can be displayed to the user. For example, auser may initiate a calibration through dedicated display 104, and uponsuccessful completion the continuous glucose sensor system 100 may sendthe updated data relating to glucose values to both dedicated display104 and display 106 in the same communication interval. This avoids theissue of having one display present outdated data to a user. The orderof generated glucose values may also be recorded so that only datavalues generated after the new calibration can be sent to the dedicateddisplay 104 a and display 106 a. In other embodiments, the new and olddata can be displayed to a user, with the old data being distinguishedfrom new data such as through a label, shading, color, or other type ofindication to a user that distinguishes the old data from new data. Inaddition, both new and old data can be collected and stored for lateranalysis and troubleshooting.

FIG. 12 illustrates an exemplary state diagram for a continuous glucosesensor system 100 and its transmitter's connections. At 1200, thetransmitter 101 may be in a storage mode prior to installation or usewith the continuous glucose sensor system 100. The storage mode may be amode the transmitter 101 is initially sold in and may include a lowpower consumption state. When the connection with the continuous glucosesensor system 100 is detected, the transmitter 101 may enter an activemode 1202 for future operation. Upon initial startup, the transmitter101 may enter active mode 1202 automatically within a period of time,such as ten minutes, after being connected to an active continuousglucose sensor system 100. A new display may scan to identify atransmitter 101 becoming active for a period of time after a user entersthe transmitter identifier using the display. In one example, thedisplay may scan for ten minutes upon entry of a transmitter identifier,giving the user time to connect the transmitter 101 to the continuousglucose sensor system 100 and allow the transmitter 101 to activate.

As discussed previously, the transmitter 101 may periodically enter asleep mode 1204 and emerge from the sleep mode back into the active mode1202 at predetermined intervals. The transition to active mode may bedone to accommodate raw sensor data collection 1206, which may be anongoing process where the continuous glucose sensor system 100 takes aseries of raw data values from a user. The raw data values may undergoalgorithmic processing 1208 by the continuous glucose sensor system 100.The algorithmic processing may convert raw data values, such as voltagesor current measurements, into familiar units of glucose levels, such asmg/dL, based on calibration values.

Periodically, the transmitter 101 may enter an advertising state 1210.The advertising state will advertise for any nearby displays that seekto connect with the continuous glucose sensor system 100 and receivedata relating to glucose levels create by the algorithmic processingstep 1208. The advertising state may continue for a period of time, suchas seven seconds. If no display is detected during advertising, thetransmitter 101 may terminate advertising and enter a sleep mode 1204for a period of time, such as five minutes, until the next connectioninterval.

If, however, a display is detected in response to the advertising state1210, an authentication mode 1212 occurs whereby the transmitter 101engages in the authentication processes previously described. Inparticular, the display may validate the advertising packet byperforming a hashing algorithm based on the transmitter identifierentered by the user. The authentication process also can include sendinga challenge from the display to the transmitter 101 using thetransmitter identifier and sending an application key request.Additionally, a device type for the display can be sent to check againsta whitelist. If authentication with a given display fails, such as whenthe display is not on the white list, does not successfully negotiatehashing algorithms or key exchange, or for other reasons, thetransmitter 101 may resume an advertising state 1210 to determine if anyother displays seek a connection.

If the authentication mode is successful, the transmitter 101 will entera state acknowledging that a display is active for this session at 1214.While the display is active, it may send a command via a request to thetransmitter 101. The transmitter 101 enters a command active state 1216and processes the command, such as by undergoing a calibration process,and sends a response. After the command has been processed, the sessionmay be terminated, causing the transmitter 101 to resume the advertisingstate for any other displays that seek communications. If none respond,the transmitter 101 will transition back to a sleep mode 1204 until thenext active mode state 1202.

FIG. 13 illustrates an exemplary embodiment of communications between atransmitter 101 and a dedicated display 104 a or a display 106 a whileauthenticating and pairing. FIG. 13 is an example of the implementationrelating to FIG. 4 previously described. At step 1300, the transmitter101may advertise with packets that include the name of the transmitterto facilitate a connection. For example, the name of the transmitter maybe displayed on the graphical user interface of a display for a user toselect to proceed with a connection. In other embodiments, selection isnot necessary because the connection process may proceed automatically.

At step 1302, the display and the transmitter 101 may establish anunsecured connection. The connection process involves the displayvalidating the advertising packet that included the transmitter hashedvalue. The validation process may be executed using a hashing algorithmon a transmitter identifier entered by a user with the display. If thehashing values match, the connection process continues. If not, theconnection process terminates.

At step 1304, the display requests a challenge by sending a challengevalue. The challenge may use the transmitter identifier or anapplication key with a display type in the request. An error in thepacket may result in an error response being returned from thetransmitter. If the packet is received properly, the transmitter 101and/or continuous glucose sensor system 100 can compute the hash usingthe display challenge value and, for example, an AES 128 algorithm thatuses the transmitter identifier as a key.

Next, the transmitter 101 and/or continuous glucose sensor system 100computes a hash value based on the display challenge value, with thetransmitter identifier as a key, and sends the computed hash value backto the display at step 1306. The display compares the receivedtransmitter hash value with the hash value computed by the display. Ifthe two match, the connection sequence continues. If not, the connectionterminates. The response to the challenge from the display can alsoinclude a challenge value from the transmitter 101. In this manner, thedisplay may challenge the transmitter 101, and the transmitter 101 maychallenge the display.

At step 1308, the transmitter 101 and display execute the bondingprocess. In one embodiment, the display may calculate a hash value basedon the challenge value received from the transmitter 101, again usingthe transmitter identifier as a key. The display sends the computed hashvalue back to the transmitter 101. If any error is detected in thepacket, an error response can be returned from the transmitter 101. Ifno error exists, the transmitter 101 compares the received hash valuefrom the display with its own computed hash value. When the two hashvalues match, the sequence continues. Otherwise, the connection isterminated. At this point the display and the transmitter 101 haveundergone two-way authentication and a secure connection is established.On the first connection, a short and long-term key may be exchanged. Thepairing and bonding process is complete, and the bonding table or listcan be updated with the bonding information, including the hashedvalues, keys, long-term key, short-term key, device types, and othervalues used to establish communications. Communications and transmissionof data relating to glucose levels can now be sent to the display, andthe display can send any commands or other information to thetransmitter 101.

In one embodiment, the display can also send an application key to thetransmitter 101 at step 1310. The transmitter 101 can initially use thetransmitter identifier for the encryption key, but the key can bechanged to strengthen application security. The transmitter identifiercan be printed on the back of the transmitter 101, which can lead to itbeing compromised. Also, the transmitter identifier remains the samevalue over time, so it is subject to repeated attacks over time.Switching to an application key provides enhanced security and theability to change the key over time. The application key can be sentover a secure link that employs encryption, such as Bluetoothencryption.

The display can store the application key and the prior application keyin permanent, non-volatile memory. The transmitter 101 records the newapplication key and sends an indication back to the display that theapplication key was accepted at step 1312. Upon receiving a responseindicating the application key was accepted, the transmitter 101 can, inone embodiment, delete the old application key. Communications can alsobe tested using the new application key prior to deleting the oldapplication key. If the display does not receive a response indicatingacceptance of the application key, it keeps the old application key andthe new application key. On the next communication cycle when thetransmitter 101 enters the awake state, the display may first attempt touse communications with the new application key. If successful, the oldapplication key may be deleted. If not, communications may continue withthe old application key, and the display may reinitiate the process ofsending the transmitter 101 a new application key.

FIG. 14 illustrates exemplary use cases in which a connection can berejected. One example is when an unknown device type attempts to connectwith a continuous glucose sensor system 100, as shown at 1402. Thedevice type may be a unique value designed for exchange with thecontinuous glucose sensor system 100. As a result, a display that sendsa device type not conforming the expected values will have itsconnection request rejected at 1400.

Another example is when a duplicate device type occurs at 1404. In oneembodiment, only one device for a dedicated display 104 a and onedisplay 106 a can connect during each communication interval. Although auser may have, for example, two smartphones, each of which can connectwith the continuous glucose sensor system 100, only one connection withthat device type can be allowed in a given communication interval. Thesecond device having a duplicate device type can have its connectionrequest rejected.

A device that is actively and has previously connected with thecontinuous glucose sensor system 100 can also be rejected when it doesnot follow the authentication protocol, as shown at 1406. In oneembodiment, displays can be required to follow the authenticationprotocol for every communication interval and corresponding connectionrequest. A device that is active and included in the white list canstill be rejected if it attempts to bypass the authentication protocol.

Another example of rejecting a connection request involves a hash valuemismatch 1408. The hash value mismatch can occur in either step of thetwo-way authentication process, causing the continuous glucose sensorsystem 100 to reject that connection request for a given communicationinterval. Finally, another example involves repeated application keyfailure at 1410. If authentication fails with an application key, thedisplay can disconnect from the transmitter 101 and reject theconnection. This process can repeat in the next communication interval.On the third cycle, the display can attempt to connect with theapplication key again, and if that fails, it can revert to using thetransmitter identifier as the key to authenticate. The display can thenestablish and exchange a new application key.

FIG. 15 illustrates exemplary use cases for connecting displays. In afirst example, no display may be in the area at 1500, so the transmitter101 may advertise for one period and then resume the sleep state at1502. If a display is in the wireless communication range at 1510, butthe display is not authenticated properly within the allotted time, thetransmitter 101 may resume the advertising state provided theadvertisement period (such as 7 seconds) has not yet expired. Afterthere is an advertisement timeout, the transmitter 101 will go to thesleep state at 1512.

If a display is in the vicinity that authenticates correctly and bondswith the transmitter at 1520, the transmitter 101 may limit bondingafter authentication and take other actions shown at 1522. Inparticular, after authentication, bonding can be available only for thetype of display that is currently connected. After a connection timeoutor disconnection, the transmitter 101 can resume the advertising state,in the same communication interval, with the whitelist filter disabled.On the next communication interval, the whitelist filter can be activefor the first advertising period. Then, the whitelist filter can bedisabled for the second advertising period. When the whitelist filter isenabled, other un-bonded displays can be rejected and the transmitter101 can transition to the advertising state.

If two displays authenticate correctly and bond with the transmitter 101at step 1530, the transmitter 101 may have the whitelist active andconnect both displays at 1532. In particular, the whitelist filter canbe active for the two advertising periods per communication interval.Both bonded displays are allowed to connect to the transmitter 101 inthe same communication interval. When the whitelist filter is enabled,other un-bonded displays are rejected and the transmitter 101transitions to the advertising state.

If a previously connected and bonded display does not connect to thetransmitter 101 for a given number of communication intervals at 1540,such as two intervals, the previously connected display can be removedfrom the whitelist at 1542. The bonding information of the absentdisplay can be retained in the bonding list. In this example, thewhitelist filter can be active for the first advertising period to givepreference to the already bonded display. The whitelist filter can bedisabled for the second communication interval to allow another displayto connect and authenticate. Once the allowed bond for a given type ofdisplay is taken, another display of the same type will be deniedbonding even if it authenticates properly. After this denial, thetransmitter 101 can go to the advertising state provided theadvertisement period has not expired yet.

If a previously bonded display, such as a smart phone, that was erasedfrom the whitelist attempts to reconnect at 1550, the previously bondeddisplay will not have to manually accept the bond request provided it isstill in the bonding list. Bonding instead proceeds automatically at1552.

If an additional device bonds when the bonding list is full at 1560, thebonding information for the oldest bonded display can be overwritten at1562. In one embodiment, the bonding list can maintain a circular queuethat stores up to three displays. When an additional display bonds andthe queue is full, the transmitter 101 can overwrite the oldest bondinginformation.

At 1570, a clear command can also be provided from an authenticated andbonded display to deletes all bonds. The transmitter 101 can clear thewhitelist and delete all bonding information at 1572 in response to theclear command.

FIG. 16 illustrates an exemplary state diagram for a dedicated display104 a and/or a display 106 a. One issue that arises is transitioning thedisplay in and out of various states during use, such as an idle statebetween communication intervals, a state of searching for availableconnections, and an active state of data transmissions. The method ofFIG. 16 illustrates these transitions between various states consistentwith certain embodiments.

At 1600, the display may be in a locked state. In the locked state, thedisplay has successfully connected and paired with a transmitter 101. Asynchronization characteristic can be shared between the two devices,allowing them to coordinate the next advertising event. In this state,the display will not have any radio activity with the continuous glucosesensor/transmitter between each connection cycle, which may occurapproximately every 5 minutes. During this state, the display can scanfor a period of time, such as twenty-five seconds, to reconnect to thetransmitter 101. In addition, an additional lead time, such as 500ms,can be added for additional scanning before the coordinatedadvertisement event. If the display does not connect to the transmitter101 on the first attempt, it can retry at five minute intervals from theoriginal coordinated advertisement event. After thirty minutes of notfinding the transmitter 101, the display can fall out of locked stateand into search state at 1602. In addition, the display can transitionfrom a locked to a search state if a user changes the transmitteridentifier, indicating a new transmitter has entered the system.

In the search state 1602, the display can scan frequently to discoverthe transmitter 101. For example, the display can scan for twenty-fiveseconds followed by five seconds of no radio activity. If no transmitter101 is discovered after five minutes, the display can enter an idlestate at 1604. If the transmitter 101 is connected and bonded, thelocked state will be entered as shown at 1608. The search state can alsocontinue where the transmitter identifier is changed by a user, a startsensor session command is received, or when a user wakes up the screenor executes the application for glucose monitoring.

The display can enter an idle state 1604 if the display has notdiscovered the desired transmitter 101 in the search state. During thistime, there may not be any radio activity. After a period of time, suchas one hour, the display can re-enter the search state as shown at 1610.A transition to the search state may also occur if user driven commandsare received, such as a command to set or update a transmitteridentifier, start a sensor session, or when a user wakes up the screenor executes the application for glucose monitoring.

Reference will now turn to FIG. 17, which illustrates an exemplarymethod for calibrating a continuous glucose sensor system 100 withmultiple displays. The continuous glucose sensor system 100 may includea sensor 103 or other device for sampling data relating to glucoselevels from the body. The sensor 103 may need replaced periodically, andpart of the replacement process involves calibrating a new sensor 103.The calibration process may occur, for example, using a blood glucosemeasurement that is taken using another measurement device, such as asingle point blood glucose finger stick meter. A user may stop their oldsensor, insert a new sensor, and reconnect the new sensor to thetransmitter. Once the new sensor has been inserted, the user may useeither dedicated display 104 a or display 106 a to start the new sensor,enter a warm-up period, and perform calibration.

Once the warm-up period is complete, the continuous glucose sensorsystem 100 may transmit a message to the dedicated display 104 a anddisplay 106 a to prompt a user to perform a calibration. The user maytake their blood glucose level using a blood glucose meter and enter thevalue into the dedicated display 104 a or display 106 a to initiatecalibration of the sensor 103. In some implementations, the displaytransmits the calibration value to the continuous glucose sensor system100 and the continuous glucose sensor system 100 algorithmicallyprocesses the calibration value to calibrate the sensor 103 and generatecalibrated sensor data. This process may occur multiple times during asession using the sensor 103, so that two blood glucose calibrationvalues may be used to obtain a higher accuracy in the calibration.

In FIG. 17, a user may choose to perform the calibration process witheither display, and may sometimes enter a value into both displays. Themethod of FIG. 17 processes the received calibration values andcoordinates the calibration values between the continuous glucose sensorsystem 100 and both of the displays.

At step 1700, a user may enter a blood glucose value on a first display,such as dedicated display 104 a. The blood glucose value may be obtainedusing a single point blood glucose meter. The first display may beupdated to indicate the calibration value was received. Optionally, theuser may also enter the same value on a second display, such as display106 a, at step 1702. The second display may also be updated to indicatethe calibration value was received. Each of the displays may transmitthe glucose value to the continuous glucose sensor system 100 at steps1704 and 1706.

At step 1708, the continuous glucose sensor system 100 processes thefirst received glucose value. The transmitter 101 and/or continuousglucose sensor system 100 performs calibration using the first bloodglucose value that was received and returns an updated glucose value,trending arrow, and estimated error range to the display that sent thefirst blood glucose value. The second received glucose value may then beprocessed at step 1710. In one embodiment, the second received bloodglucose value from the second display may not be used, and instead thetransmitter 101 can send a message to the second display indicating thatcalibration was already performed on another device. The second displaymay then request the updated values and the transmitter 101 will returnthe current glucose levels, trending arrow, and other data relating toglucose levels to the second display. At this point, the second displaywill be updated to show the same information as the first display.

In some embodiments, the glucose values from the first and seconddisplay need not be the same. The user may take multiple measurementsand enter the blood glucose calibration values on multiple displays.Still, the first-received blood glucose value within a time interval,such as ten minutes, can be used and the second-received blood glucosevalue may be ignored by the transmitter 101. In some embodiments, thesecond-received blood glucose value can be used, even when it wasprovided within the time interval, when the second-received bloodglucose value differs from the first-received blood glucose value by adefined amount. This may indicate that an error occurred with taking thefirst-received blood glucose value. For example, if the first-receivedblood glucose value and the second-received blood glucose value differby more than 20 mg/dL, the second-received blood glucose value may beused to calibrate, either instead of or in addition to thefirst-received blood glucose value.

In another embodiment, a user may enter a blood glucose value on thefirst and second display, and the first display sends its blood glucosevalue to the transmitter 101. The transmitter 101 sends a blood glucoseacknowledgment to the first display, but it may indicate an error orfailure in the calibration process. The first display may then requestdata relating to glucose values and receive an indication thatcalibration failed. The first display therefore can update the displayto reflect that calibration is still required due to the error status.Subsequently, the second display can send its blood glucose value to thetransmitter 101, which will note that the blood glucose value is aduplicate of the value already received from the first display. Thesecond display will receive an indication that calibration failed inresponse to a request for data relating to glucose levels. The user maythen re-enter the blood glucose value on one or both of the displays,which may cause the process of FIG. 17 to perform again, this timeresulting in accepted values and successful calibration.

The user need not enter the blood glucose value on both displays. Forexample, where a single display is used, the calibration can occur andbe successful, resulting in the updated data relating to glucose valuesbeing displayed on both displays. In one embodiment, a second displaymay receive data relating to glucose values, then the first display canbe used to start the calibration process. The first display may performcalibration and show updated values while the second display waits untilanother communication interval to receive updated data relating toglucose values. The two displays will therefore show the same valuesafter the next communication interval.

FIG. 18 illustrates an exemplary system for monitoring glucose levels.The system of FIG. 18 may be used in conjunction with the previouslydescribed embodiments. The system may include a continuous glucosesensor system 1800, wireless connections 1802 a-b, dedicated display1804, and a display 1806 executing applications. The dedicated display1804 may be connected using either a wired or wireless connection tocomputer 1802. Computer 1802 may be, for example, a personal computer,tablet, laptop, smart phone, or server. In addition, dedicated display1804 may connect to display 1806, and display 1806 may connect tocomputer 1802.

Computer 1802 and display 1806 may connect to cloud storage 1804, whichmay provide long-term storage of data relating to glucose values, healthinformation, system calibrations, and other information relating tocontinuous glucose monitoring. Cloud storage 1804 may include aplurality of storage devices, computers, and network connections.Communications between dedicated display 104, computer 1802, display106, and cloud storage 1804 may use encryption to prevent unauthorizedaccess to medical data.

Cloud storage 1802 may connect to a back-end system 1806. The back-endsystem 1806 may provide technical support 1808 for a user in configuringand using the continuous glucose monitor. The back-end system 1806 mayalso monitor system information, such as versions of software executingon continuous glucose sensor system 1800, dedicated display 1804,display 1806, and computer 1802. Updates may be provided on demand orpushed to a user using network connections in a secure fashion.

Another display 1810 may also connect to cloud storage 1802. The display1810 may include a dedicated application 1812 and one or morethird-party applications 1814, which can be used to monitor and displayglucose values. A user of continuous glucose sensor system 1800 mayallow additional people to monitor their glucose levels and other healthinformation. For example, a child may wear the continuous glucosemonitor and have an associated dedicated display 1804 and display 1806.The child may designate one or both of their parents as additional userswho can access the child's glucose levels and other health informationusing display 1810. The display 1810 may be, for example, the parent'ssmart phone.

The continuous glucose data may be provided to cloud storage 1804 andmonitored by cloud storage 1804, back-end 1806, and/or display 1802. Thedisplay 1802 may receive and display continuous glucose values asdescribed previously, either without restriction or subject torestrictions as with third-party applications. The restrictions may beset by the user of the continuous glucose monitor in some embodiments.In other embodiments, the user of display 1810 may set any restrictionsfor data it receives through an authenticated process between the userof continuous glucose sensor system 1800, the user of display 1810, andback-end 1806. For example, the users may call the back-end and answersecurity questions before establishing the appropriate operation of thesystem, or this process may be completed online. Once complete, the userof continuous glucose sensor system 1800 or the user of display 1810 maybe restricted in the data their device receives or their ability tochange system operation. This can prevent a user of continuous glucosesensor system 1800 from restricting monitoring by display 1810, such aswhen a child may eat a lot of sweet food at a birthday party that cancause a spike in glucose levels.

FIG. 19 illustrates an exemplary computer for monitoring glucose levels.Continuous glucose sensor system 1800, dedicated display 104 a, display106 a, computer 1802, cloud storage 1804, back-end 1806, and display1810 may all include the components shown in FIG. 19.

The computers may include one or more hardware components such as, forexample, a central processing unit (CPU) 1921, a random access memory(RAM) module 1922, a read-only memory (ROM) module 1923, a storage 1924,a database 1925, one or more input/output (I/O) devices 1926, and aninterface 1927. Alternatively and/or additionally, the computer mayinclude one or more software components such as, for example, acomputer-readable medium including computer executable instructions forperforming a method associated with the exemplary embodiments. It iscontemplated that one or more of the hardware components listed abovemay be implemented using software. For example, storage 1924 may includea software partition associated with one or more other hardwarecomponents. It is understood that the components listed above areexemplary only and not intended to be limiting.

CPU 1921 may include one or more processors, each configured to executeinstructions and process data to perform one or more functionsassociated with a computer for monitoring glucose levels. CPU 1921 maybe communicatively coupled to RAM 1922, ROM 1923, storage 1924, database1925, I/O devices 1926, and interface 1927. CPU 1921 may be configuredto execute sequences of computer program instructions to perform variousprocesses. The computer program instructions may be loaded into RAM 1922for execution by CPU 1921.

RAM 1922 and ROM 1923 may each include one or more devices for storinginformation associated with operation of CPU 1921. For example, ROM 1923may include a memory device configured to access and store informationassociated with controller 1920, including information for identifying,initializing, and monitoring the operation of one or more components andsubsystems. RAM 1922 may include a memory device for storing dataassociated with one or more operations of CPU 1921. For example, ROM1923 may load instructions into RAM 1922 for execution by CPU 1921.

Storage 1924 may include any type of mass storage device configured tostore information that CPU 1921 may need to perform processes consistentwith the disclosed embodiments. For example, storage 1924 may includeone or more magnetic and/or optical disk devices, such as hard drives,CD-ROMs, DVD-ROMs, or any other type of mass media device.

Database 1925 may include one or more software and/or hardwarecomponents that cooperate to store, organize, sort, filter, and/orarrange data used by CPU 1921. For example, database 1925 may datarelating to monitoring glucose levels, associated metadata, and healthinformation. It is contemplated that database 1925 may store additionaland/or different information than that listed above.

I/O devices 1926 may include one or more components configured tocommunicate information with a user associated with controller 1920. Forexample, I/O devices may include a console with an integrated keyboardand mouse to allow a user to maintain a database of images, updateassociations, and access digital content. I/O devices 1926 may alsoinclude a display including a graphical user interface (GUI) foroutputting information on a monitor. I/O devices 1926 may also includeperipheral devices such as, for example, a printer for printinginformation associated with controller 1920, a user-accessible diskdrive (e.g., a USB port, a floppy, CD-ROM, or DVD-ROM drive, etc.) toallow a user to input data stored on a portable media device, amicrophone, a speaker system, or any other suitable type of interfacedevice.

Interface 1927 may include one or more components configured to transmitand receive data via a communication network, such as the Internet, alocal area network, a workstation peer-to-peer network, a direct linknetwork, a wireless network, or any other suitable communicationplatform. For example, interface 1927 may include one or moremodulators, demodulators, multiplexers, demultiplexers, networkcommunication devices, wireless devices, antennas, modems, and any othertype of device configured to enable data communication via acommunication network.

Any combination of one or more computer readable medium(s) may beutilized. The computer readable medium may be a computer readable signalmedium or a computer readable storage medium. A computer readablestorage medium may be, for example, an electronic, magnetic, optical,electromagnetic, infrared, or semiconductor system, apparatus, ordevice, or any suitable combination of the foregoing. More specificexamples (a non-exhaustive list) of the computer readable storage mediumwould include the following: an electrical connection having one or morewires, a portable computer diskette, a hard disk, a random access memory(RAM), a read-only memory (ROM), an erasable programmable read-onlymemory (EPROM or Flash memory), an optical fiber, a portable compactdisc read-only memory (CD-ROM), an optical storage device, a magneticstorage device, or any suitable combination of the foregoing. Programcode embodied on a computer readable medium may be transmitted using anyappropriate medium, including but not limited to wireless, wireline,optical fiber cable, RF, etc., or any suitable combination of theforegoing.

Computer program code for may be written in any combination of one ormore programming languages, including an object oriented programminglanguage such as Java, Smalltalk, C++, or the like, and conventionalprocedural programming languages, such as the “C” programming languageor similar programming languages. The program code may execute entirelyon the computing unit.

It will be understood that each block of the flowchart illustrationsand/or block diagrams, and combinations of blocks in the flowchartillustrations and/or block diagrams, can be implemented by computerprogram instructions. These computer program instructions may beprovided to a processor of a general purpose computer, special purposecomputer, or other programmable data processing apparatus to produce amachine, such that the instructions, which execute via the processor ofthe computer or other programmable data processing apparatus, createmeans for implementing the functions/acts specified in the flowchartand/or block diagram block or blocks.

Although the term first application has been referred to as dedicatedapplication 108, it will be appreciated that a first application may beany of third party application 110˜116 or another application.Similarly, while the second application has been referred to as approvedthird-party application 110 and a health application, the secondapplication may also be dedicated application 108, any of third partyapplications 112˜116, or another application. Moreover, while certainapplications 110˜116 have been described as third-party applications, itwill be appreciated that applications 110˜116 need not be provided bythird-parties.

It should be understood that the various techniques described herein maybe implemented in connection with hardware or software or, whereappropriate, with a combination thereof. Thus, the methods andapparatuses of the presently disclosed subject matter, or certainaspects or portions thereof, may take the form of program code (i.e.,instructions) embodied in tangible media, such as floppy diskettes,CD-ROMs, hard drives, or any other machine-readable storage mediumwherein, when the program code is loaded into and executed by a machine,such as a computing device, the machine becomes an apparatus forpracticing the presently disclosed subject matter. In the case ofprogram code execution on programmable computers, the computing devicegenerally includes a processor, a storage medium readable by theprocessor (including volatile and non-volatile memory and/or storageelements), at least one input device, and at least one output device.One or more programs may implement or utilize the processes described inconnection with the presently disclosed subject matter, e.g., throughthe use of an application programming interface (API), reusablecontrols, or the like. Such programs may be implemented in a high levelprocedural or object-oriented programming language to communicate with acomputer system. However, the program(s) can be implemented in assemblyor machine language, if desired. In any case, the language may be acompiled or interpreted language and it may be combined with hardwareimplementations.

While this specification contains many specific implementation details,these should not be construed as limitations on the claims. Certainfeatures that are described in this specification in the context ofseparate implementations may also be implemented in combination in asingle implementation. Conversely, various features that are describedin the context of a single implementation may also be implemented inmultiple implementations separately or in any suitable subcombination.Moreover, although features may be described above as acting in certaincombinations and even initially claimed as such, one or more featuresfrom a claimed combination may in some cases be excised from thecombination, and the claimed combination may be directed to asubcombination or variation of a subcombination.

Similarly, while operations are depicted in the drawings in a particularorder, this should not be understood as requiring that such operationsbe performed in the particular order shown or in sequential order, orthat all illustrated operations be performed, to achieve desirableresults. In certain circumstances, multitasking and parallel processingmay be advantageous. Moreover, the separation of various systemcomponents in the implementations described above should not beunderstood as requiring such separation in all implementations, and itshould be understood that the described program components and systemsmay generally be integrated together in a single software product orpackaged into multiple software products.

It should be appreciated that the logical operations described hereinwith respect to the various figures may be implemented (1) as a sequenceof computer implemented acts or program modules (i.e., software) runningon a computing device, (2) as interconnected machine logic circuits orcircuit modules (i.e., hardware) within the computing device and/or (3)a combination of software and hardware of the computing device. Thus,the logical operations discussed herein are not limited to any specificcombination of hardware and software. The implementation is a matter ofchoice dependent on the performance and other requirements of thecomputing device. Accordingly, the logical operations described hereinare referred to variously as operations, structural devices, acts, ormodules. These operations, structural devices, acts and modules may beimplemented in software, in firmware, in special purpose digital logic,and any combination thereof. It should also be appreciated that more orfewer operations may be performed than shown in the figures anddescribed herein. These operations may also be performed in a differentorder than those described herein.

What is claimed is:
 1. A method for establishing communication between aplurality of display devices and a transmitter of a continuous glucosemonitoring system, comprising: receiving a request to connect thetransmitter with a first display device, the request identifying a firsttype of the first display device; comparing the first type of the firstdisplay device with a list including a plurality of allowed types ofdisplay devices; determining whether a display device having the firsttype is actively connected with the transmitter; connecting thetransmitter with the first display device when fewer than apredetermined number of display devices with the first type are includedin the list; receiving a request to connect the transmitter with asecond display device, the request identifying a second type of thesecond display device; comparing the second type of the second displaydevice with the list including a plurality of allowed types of displaydevices; determining whether a display device having the second type isactively connected with the transmitter; and connecting the transmitterwith the second display device when fewer than the predetermined numberof display devices with the second type are included in the list.
 2. Themethod of claim 1, wherein the first type of device comprises a smartphone and the second type of device comprises a dedicated display. 3.The method of claim 2, further comprising: pairing the first displaydevice and the second display device with the transmitter; and storingbonding information as a result of pairing the first display device andthe second display device with the transmitter in a second list.
 4. Themethod of claim 1, further comprising rejecting the request to establishcommunication between the transmitter and the first display device whenanother display device with the first type is actively connected.
 5. Themethod of claim 1, further comprising rejecting the request to establishcommunication between the transmitter and the second display device whenanother display device with the second type is actively connected. 6.The method of claim 1, wherein the predetermined number of displaydevices is two.
 7. The method of claim 1, further comprising: adding thefirst display device to the list after connecting the transmitter withthe first display device; and adding the second display device to thelist after connecting the transmitter with the second display device. 8.The method of claim 1, further comprising: receiving a request to removethe first display device from the list; terminating communications withthe first display device; and removing the first display device from thelist.
 9. The method of claim 1, further comprising connecting theplurality of display devices with the transmitter periodically atcommunication intervals.
 10. One or more computer-readable mediacomprising instructions which, when executed by one or more processors,perform a method for establishing communication between a plurality ofdisplay devices and a transmitter of a continuous glucose monitoringsystem, comprising: receiving a request to connect the transmitter witha first display device, the request identifying a first type of thefirst display device; comparing the first type of the first displaydevice with a list including a plurality of allowed types of displaydevices; determining whether a display device having the first type isactively connected with the transmitter; connecting the transmitter withthe first display device when fewer than a predetermined number ofdisplay devices with the first type are included in the list; receivinga request to connect the transmitter with a second display device, therequest identifying a second type of the second display device;comparing the second type of the second display device with the listincluding a plurality of allowed types of display devices; determiningwhether a display device having the second type is actively connectedwith the transmitter; and connecting the transmitter with the seconddisplay device when fewer than the predetermined number of displaydevices with the second type are included in the list.
 11. Thecomputer-readable media of claim 10, wherein the first type of devicecomprises a smart phone and the second type of device comprises adedicated display.
 12. The computer-readable media of claim 10, furthercomprising instructions which, when executed by the processor: pair thefirst display device and the second display device with the transmitter;and store bonding information as a result of pairing the first displaydevice and the second display device with the transmitter in a secondlist.
 13. The computer-readable media of claim 10, further comprisinginstructions which, when executed by the one or more processors, rejectthe request to establish communication between the transmitter and thefirst display device when another display device with the first type isactively connected.
 14. The computer-readable media of claim 10, furthercomprising instructions which, when executed by the one or moreprocessors, reject the request to establish communication between thetransmitter with the second display device when another display devicewith the second type is actively connected.
 15. The computer-readablemedia of claim 10, wherein the predetermined number of display devicesis two.
 16. The computer-readable media of claim 10, further comprisinginstructions which, when executed by the one or more processors: add thefirst display device to the list after connecting the transmitter withthe first display device; and add the second display device to the listafter connecting the transmitter with the second display device.
 17. Thecomputer-readable media of claim 10, further comprising instructionswhich, when executed by the one or more processors: receive a request toremove the first display device from the list; terminate communicationswith the first display device; and remove the first display device fromthe list.
 18. The computer-readable media of claim 10, furthercomprising instructions which, when executed by the one or moreprocessors: connect the plurality of display devices with thetransmitter periodically at communication intervals; and store bondinginformation in a second list as a result of the connecting.
 19. A systemfor establishing communication between a plurality of display devicesand a transmitter of a continuous glucose monitoring system, comprising:a first display device; a second display device; a wireless receiver inthe transmitter configured to receive a request to connect thetransmitter with a first display device, the request identifying a firsttype of the first display device; a memory in the transmitter configuredto store a list of allowed types of display devices; a processor in thetransmitter configured to: compare the first type of the first displaydevice with the list; determine whether a display device having thefirst type is actively connected with the transmitter; connect thetransmitter with the first display device when fewer than apredetermined number of display devices with the first type are includedin the list; receive a request to connect the transmitter with a seconddisplay device, the request identifying a second type of the seconddisplay device; compare the second type of the second display devicewith the list including a plurality of allowed types of display devices;determine whether a display device having the second type is activelyconnected with the transmitter; and connect the transmitter with thesecond display device when fewer than the predetermined number ofdisplay devices with the second type are included in the list.
 20. Thesystem of claim 19, wherein the first type of display device comprises asmart phone and the second type of display device comprises a dedicateddisplay.
 21. The system of claim 19, wherein the processor is furtherconfigured to: pair the first display device and the second displaydevice with the transmitter; and store bonding information as a resultof pairing the first display device and the second display device withthe transmitter in a second list.
 22. The system of claim 19, whereinthe processor is further configured to reject the request to establishcommunication between the transmitter and the first display device whenanother display device with the first type is actively connected. 23.The system of claim 19, further the processor is further configured toreject the request to establish communication between the transmitterwith the second display device when another display device with thesecond type is actively connected.
 24. The system of claim 19, whereinthe predetermined number of display devices is two.
 25. The system ofclaim 19, wherein the processor is further configured to: add the firstdisplay device to the list after connecting the transmitter with thefirst display device; and add the second display device to the listafter connecting the transmitter with the second display device.
 26. Thesystem of claim 19, wherein the processor is further configured to:receive a request to remove the first display device from the list;terminate communications with the first display device; and removing thefirst display device from the list.
 27. The system of claim 19, wherein:the plurality of display devices are connected with the transmitterperiodically at communication intervals; and bonding information isstored in a second list as a result of the connecting.